THE  GREAT  PATENT  DEBATE:  Burden  on 


THE  RESOURCE  FOR  INFORMATION  EXECUTIVES 


PLUS 


Schrage  on  Why 
IT  Is  Strategic 

And  Why  Those  Who 
Don’t  Think  So  Are 
Just  Plain  Wrong 

Page  30 


How  IT  Could  Save 
$44  Billion  in  Annual 
U.S.  Health-Care  Costs 

And  Why  That  Won’t 
Happen  Any  Time  Soon 

Page  52 


DENIAL  CAN  MAKE  YOU  FAT 
GET  YOU  FIRED 
AND  EVEN  KILL  YOU... 


Here’s  How  to  Recognize  the  Signs  of  Stress, 
And  What  to  Do  About  Them  Page  40 
BY  CHRISTOPHER  KOCH 


AUGUST  1,  2003  •  $9.00  CIO.COITI 


©  20tl3  Microsoft  Corporation.  All  rights  reserved.  Microsoft,  Windows,  the  Windows  logo,  and  Windows  NT  are  either  registered  trademarks  or  trademarks  of 
Microsoft. Corporation  in  the  United  States  and/or  other  countries.  LexisNexis  is  a  trademark  of  Reed  Elsevier  Properties  Inc.,  used  with  the  permission  of  LexisNexis. 


- - 


Delivering  100,000  searches  will  take  two  hours 


Introducing  Microsoft  Windows  Server  2003.  Do  more  with  less 


You’re  being  asked  to  do  more.  You’re  being  asked  to  do  it  with  less.  Microsoft  Windows  Server  2003  is  designed 
to  help  you  manage  these  opposing  forces,  and  get  the  most  from  your  infrastructure  with  less  time,  money,  and 
hassle.  New  servers  with  Windows  Server  2003  can  deliver  twice  the  performance  at  half  the  cost  of  existing 
Windows  NT  4.0  Servers.  Now  that’s  doing  more  with  less.  Get  your  free  evaluation  copy  of  Windows  Server  2003  at 
microsoft.com/windowsserver2003  by  July  31, 2003,  to  see  your  potential  gains.  Software  for  the  Agile  Business. 


LexisNexis'"  searches  billions  of  documents  to  deliver  access  to  authoritative  news,  legal,  and  business  information.  After 
testing  multiple  platforms,  LexisNexis  chose  Windows  Server  2003  for  one  of  its  new  search  programs  because  of  the 
superior  performance  and  lower  support  costs  compared  to  other  operating  systems  tested. 


You  don’t  have  two  hours. 


Microsoft 


THERE 

MAY  BE  A  BIGGER 
INTEGRATION  SOFT 

OUT  THERE 
SOMEWHERE. 


TIBCO  Software  has  made  real-time  business  and  integration  a  reality  for  more  than 
easily-deployed  solutions.  To  discover  why  TIBCO  continues  to  be  chosen  over  all 


INDEPENDENT 
WARE  PROVIDER 


BUT  UNTIL  SCIENTISTS  MAKE  CONTACT, 

WE  PROUDLY  OFFER  THE  SERVICES  OF  THE  EARTH’S  LARGEST. 


,000  leading  companies.  The  reasons?  Our  proven,  comprehensive  and 
ie  integration  providers  out  there,  call  800-420-8450  or  visit  www.tibco.com. 


B8TIBCO 

The  Power  of  Now™ 


Cover  Story 

PERSONAL  MANAGEMENT  I  40 


VOL.  16  •  NO.  20  •  AUGUST  1,  2003 


No  stress  toys  were  harmed 
in  the  production  of  this  feature. 


Are  you  putting  on  a  little  weight?  Do  you  think  no  one  understands  you? 

Do  you  feel  out  of  control?  Of  course  you  do.  Why  should  you  be  different  from  any  other  CIO? 
Here’s  why  you  need  to  stop,  take  a  look  around  and  change  your  ways,  by  Christopher  koch 


Features 


SPECIAL  REPORT  I  I.T.  &  HEALTH  CARE 
Part  1:  Paperless  Medicine 
Saving  Money,  Saving  Lives  I  52 

Health-care  CIOs  face  intense  pressure  to  install  electronic  medical 
records  and  order-entry  systems,  in  spite  of  physician  resistance 
and  large  up-front  costs.  Here’s  how  early  adopters  are  overcom¬ 
ing  the  obstacles.  By  Sarah  D.  Scalet 

Part  2:  Mobile  Medicine 

Wireless:  Just  What  the  Doctor  Ordered  I  60 

As  medical  records  go  electronic,  hospital  CIOs  are  finding  that 
wireless  networks  can  get  the  records  to  where  the  doctors  and 
nurses  want  to  use  them.  CIOs  in  other  industries  would  do  well 
to  watch  and  learn.  By  Galen  Gruman 


INTELLECTUAL  PROPERTY 

The  Great  Debate  Over  Software  Patents  I  66 

CIOs  are  paying  higher  prices  for  software  while  small  inventors 
and  industry  giants  threaten  each  other  with  software  patents. 
Has  the  venerable  patent  system  finally  broken  down? 

By  Mark  Radcliffe  and  Lawrence  Rosen 

MORE  ►►► 


COVER  PHOTO  BY  FURNALD/GRAY 


Goodbye  risk.  Hello  ca  smart7: 


There's  no  room  for  chance  in  the  IT  world.  That's  why 
you  can  rest  easy  when  you  see  the  ca  smart  logo, 
ca  smart  certifies  IT  solutions  that  integrate  with 
CA  solutions  to  help  drive  value  for  your  business.  In  this 
ever-changing  field,  it's  comforting  to  have  one  sure  thing. 
For  more  information,  visit  ca.com/casmart. 


Computer  Associates® 


Columns 

MAKING  I.T.  WORK 

Why  IT  Really  Does  Matter  I  30 

Businesses  can  indeed  differentiate  them¬ 
selves  through  IT.  It’s  all  a  question  of  how 
they  manage  the  technology. 

By  Michael  Schrage 

THE  NEW  WORK  ORDER 
Serenity  Now!  I  34 

If  businesses  don’t  find  a  way  to  help  the 
knowledge  worker  manage  information 
technology,  today’s  confusion  will  lead 
to  tomorrow’s  insanity. 

By  Tom  Davenport 

Sections 


HOTSEAT  I  71 

Your  Guide 
to  Managing 

Chief  Change  Officer 

A  CIO  helps  lead  a  company  back  to 
profitability.  By  Stephanie  Overby 

Management  Reports  I  74 

The  Management  Toolkit:  Pulling  out  all 
the  stops  to  get  restarted. 

Leadership  Agenda  I  76 

Full-cycle  governance  is  the  only 
way  to  ensure  project  success. 

By  Susan  H.  Cramm 


“A  company's  greatest  asset  is  its  intelligence, 
and  that  asset  resides  in  people,"  says  Mapics 
CIO  and  Chief  People  Officer  Sandra  Hofmann. 


TRENDLINES  I  16 

IT  aids  search  for  looted  Iraqi  art; 
Offshore  debate  rages;  American  Airlines’ 
CIO  carries  on.  And  more 

BY  THE  NUMBERS  I  20 

CRM:  Desperately  seeking  success. 

ON  THE  MOVE  I  26 

CIOs  on  the  go — see  where  your  IT  peers 
are  working  now. 


EMERGING  TECHNOLOGY  I  79 
Patching  Things  Up 

The  latest  patch  management  tools  can 
help  reduce  costs  and  increase  reliability. 
By  Bob  Violino 

UNPLUGGED  I  82 

Luna  iMonitoring  is  working  on  technol¬ 
ogy  that  could  let  its  customers  remotely 
track  critical  measurements. 

COMPANY  TO  WATCH  I  83 
A  high-performance  storage  company 
seeks  some  room  on  the  lower  end. 


In  Every  Issue 

INDEX  I  86 

EXECUTIVE  SUMMARY  I  88 

Abstracts  of  all  the  feature  stories  found 
in  this  issue. 


“Somebody  once  said  that  technology  is  ‘anything 
that  doesn’t  work  very  well  yet,’  and  by  that 
definition  we’re  employing  lots  of  technology.” 

-Tom  Davenport,  New  Work  Order  columnist  Page  34 


WHY  NOT  ADMIT  THAT  THE  ONLY  TIME 
TO  DO  BUSINESS  IS  IN  REAL  TIME? 


Sun  and  PeopleSoft  enableThe  Real-Time  Enterprise™  PeopleSoft’s 
Real-Time  Enterprise  applications  allow  employees,  partners,  cus¬ 
tomers  and  suppliers  to  access  relevant  information  and  conduct 
transactions  anytime,  from  just  about  anywhere.  All  of  which  leads 
to  reduced  costs  and  increased  productivity.  But  to  ensure  your 
business  never  stops  running,  you  need  an  infrastructure  that  gets 
the  most  out  of  PeopleSoft  applications. That’s  where  Sun  comes  in. 


Sun’s  wide-open,  yet  highly  secure  infrastructure  is  available  24/7/365 
and  can  support  thousands  -  even  millions  -  of  users  simultaneously. 
Anchored  by  highly  reliable  servers,  a  Sun  infrastructure  ensures 


PeopleSoft  applications  are  always  up  and  running.  And  that  your 
business  is  always  switched  to  “on’.’  y 


% 


To  learn  more,  visit  SUN.COM/WHYNOT  M 


k 


We  make  the  net  work. 


-  2003  Sun  Microsystems.  Inc.  All  rights  reserved.  Sun,  Sun  Microsystems  and  the  Sun  logo  are  trademarks  or  registered  trademarks  of  Sun  Microsystems, 
Inc.  in  the  United  States  and  other  countries.  PeopleSoft  is  a  registered  trademark,  andThe  Real-Tittie  Enterprise  is  atrademarl«f  PeopleSoft,  Inc. 


INTRODUCE 

SALES  &  MARKETING 


TO  PRODUCTION 

WITHOUT  HAWING 

TO  WAIT  FOR  THE 

COMPANY  PICNIC. 


Advertisement 


To  succeed  today,  your  enterprise  lias  to  undergo  a 
rapid  transformation  from  a  series  of  functionally  driven 
silos  connected  by  a  common  mailroom  to  a  whole  whose 
sum  is  greater,  and  more  profitable,  than  its  parts. 
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and  more-satisfied  customers. 

Cflil,  SAY  HELLO  I©  SCM. 
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reducing  costly  stock-outs  and  overstocks. 

Your  sales  reps,  armed  with  inventory  data,  delivery 
schedules,  and  product  insight,  will  become  considerably 
more  productive. 

And  that’s  just  the  tip  of  a  very  profitable  iceberg. 

Of  course,  the  concept  of  integration  is  one  thing. 
Accomplishing  it  is  quite  another. 
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TECHNOLOGY  HAS  FINALLY  CAUGHT  UP  TO  VISION. 

For  over  a  decade,  integration  has  been  the  Holy  Grail. 
Unfortunately,  companies  had  to  spend  prohibitive 
amounts  of  money  and  time  building  custom  interfaces 
that  might  make  SCM  and  CRM  work  together. 

But  now  there’s  a  new  technology  platform  that  lets 
you  get  it  done  more  easily  than  ever  before. 

It’s  called  SAP  NetWeaver?' 

SAP  NetWeaver  is  a  comprehensive,  open  technology 
platform  that  seamlessly  connects  your  people,  information, 
and  business  processes.  This  unique  “process  approach” 
allows  all  your  departments  to  share  information  in  real 
time.  Delays,  miscommunication  and  waste  are  minimized. 
Profitability  is  increased  —  often  dramatically. 

And  since  you  can  quickly  snap  a  large  variety  of 
your  current  applications,  both  SAP  and  non-SAP,  onto 
SAP  NetWeaver,  time  to  ROI  is  significantly  reduced. 

READ  THE  EYE-OPENING  STORY. 

GET  YOUR  FREE  WHITE  PAPER. 

In  short,  integrating  SCM  and  CRM  allows  you 
to  precisely  identify  the  demand  trends  of  your  most 
profitable  customers  and  respond  with  the  product  that 
best  meets  their  needs  using  the  most  efficient  mix  of 
materials,  services  and  suppliers. 

Get  all  the  details  —  the  benefits,  the  insights,  the 
results  —  in  a  special  new  white  paper,  “Supply  Chain 
and  Demand  Chain  Integration:  The  Pathway  to  Profit  and 
Competitive  Advantage’.’ 

It’s  an  in-depth  exploration  of  how  integration  can  pro¬ 
vide  your  business  with  a  competitive  advantage  in  product 
leadership,  operational  efficiency,  and  customer  intimacy. 
Get  your  free  copy  at  sap.com/integration 
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Your  priorities 
are  dear  now. 

Finally,  you  won’t  be  distracted  by  day-to-day 
network  management  issues.  With  NextiraOne 
as  your  partner,  everything  about 
your  networks  becomes 
clear.  And  your  job 
does  too. 

At  NextiraOne, 
we  bring  clarity 
to  your  complex 
communications  networks, 
we’re  planning,  designing,  implementing, 
supporting  or  managing.  Whether  it’s  a  voice, 
data  or  converged  environment.  Whether  you’re 
in  the  United  States  or  around  the  world.  No 
matter  what,  we  provide  the  expertise,  resources, 
leadership  and  vendor-independence  that  ensure 
world-class  networks.  In  fact,  NextiraOne  is 
already  working  —  adding  clarity  —  at  almost 
500,000  sites  worldwide. 

Frankly,  with  us  on  your  side,  your  job  will 
never  be  the  same.  Instead  of  worrying  about 
the  complexities  of  your  network,  you  can 
focus  on  things  that  are  clearly  more  important. 
Like  getting  more  for  your  IT  dollar. 


I  AM  A  CISCO 
3700  ROUTER. 


I  AM  A  SNARLING 
PACK  OF 
DOBERMANS. 

I  AM  INTEGRATED  SECURITY.  I  HAVE  THE  POWER  TO  PROTECT 
YOUR  NETWORK  FROM  THE  INSIDE,  THE  OUTSIDE  AND  FROM 
EVERYWHERE  IN  BETWEEN.  I  ALWAYS  KNOW  WHO  IS  ON  THE 
GUEST  LIST  AND  HAVE  THE  POWER  TO  DENY  THOSE  WHO  AREN'T 
ON  IT.  I  SNIFF  OUT  THREATS  SO  YOU  CAN  STAY  PRODUCTIVE. 

I  AM  MORE  THAN  A  CISCO  3700  ROUTER. 


THIS  IS  THE  POWER  OF  THE  NETWORK.  nOW. 


Cisco  Systems 


cisco.com/securitynow 
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IT  Aids  Search 
for  Looted  Art 


IRAQ’S  NATIONAL  MUSEUM  in  Baghdad 
was  state-of-the-art  when  it  opened  in  1967. 
Scholars  of  Mesopotamia,  such  as  John 
Russell,  considered  the  facility  well-run. 
Despite  the  first  Gulf  War  and  United 
Nations  sanctions,  the  museum  had  pass¬ 
able  lab  equipment  and  a  partially  comput¬ 
erized  records  system.  That  was  before  the 
looting  this  spring. 

When  Russell,  an  archaeologist  at  the 
Massachusetts  College  of  Art,  returned  to 
the  Baghdad  museum  in  late  May  as  part  of 
a  U.N.  fact-finding  mission,  he  saw  the  chal¬ 
lenges  in  assessing  the  damage.  “The  com¬ 
puters  and  cameras  were  stolen.  The  offices 
were  cleaned  out,”  he  says.  Museum  staff 
and  students  were  “working  on  the  floor, 
doing  a  manual  inventory”  of  the  remaining 
collection  with  pen  and  paper. 


American  troops  guard  the  Iraq  National 
Museum  in  Baghdad  on  June  12  (above  left). 
The  museum  is  missing  many  pieces  from  its 
collection  including  the  “Warka  Head,”  a 
sculpture  dating  to  3100  B.C. 

The  looting  of  Iraq’s  museums  and 
archaeological  sites  has  raised  the  profile  of 
stolen  art  trafficking.  The  worldwide  market 
for  stolen  art  runs  as  high  as  $7  billion  a 
year,  including  $5  billion  in  antiquities, 
according  to  international  agencies. 

Digital  tools  are  playing  an  increasing  role 
in  combating  the  trade,  but  they  are  no  silver 
bullet.  Databases  of  stolen  art  and  antiquities 
are  relatively  small,  and  there’s  no  unified 
view.  It  takes  time,  money  and  logistical  sup¬ 
port  to  set  up  a  technical  response  to  plunder 

Continued  on  Page  1 8 


BIOMETRICS 

Thumbs  Down 
for  Lunch 

THE  OLD  "I  lost 
my  lunch  card” 
excuse  won’t  work 
for  students  in 
Akron,  Ohio,  this 
fall.  The  Akron 
school  board  voted  in  May  to  install 
biometric  scanners  so  middle  school 
and  high  school  students  at  18  loca¬ 
tions  will  soon  have  their  fingerprints 
checked  along  with  their  IDs  in  orderto 
be  served  lunch  in  the  cafeteria. 

School  officials  said  the  benefits  of 
the  $700,000  system  outweighed 
parents'  concerns  about  the  privacy  of 
their  kids’  fingerprints,  The  Akron 
Beacon  Journal  reported.  The  finger¬ 
print  scanners  will  automate  an  old 
system  of  checking  cards. and  taking 
meal  tickets  and  cash.  (About  58 
percent  of  Akron’s  children  qualify  for 
government  subsidized  meals.)  Funds 
earmarked  for  nutritional  programs  will 
pay  for  the  project. 

Using  the  fingerprint  scanners  isn’t 
mandatory.  Students  can  still  pay  cash 
for  meals.  While  school  officials 
pledged  to  maintain  the  privacy  of 
students'  fingerprint  algorithms,  the 
Akron  school  system’s  website  notes 
the  lunch-line  system  is  flexible.  “This 
technology  can  also  be  used  for  other 
purposes,"  it  states.  "For  example,  it 
could  be  used  to  improve  security, 
attendance  reports  and  transportation 
programs."  -Michael  Goldberg 


1  6 


CIO  AUGUST  1,  2003 


www.cio.com 


PHOTO  FAR  LEFT  BY  AP/WIDE  WORLD  PHOTOS:  FAR  RIGHT  BY  PHOTODISC 


Enterprise  Intelligence  |  Supplier  Intelligence  |  Organizational  Intelligence  |  Customer  Intelligence  |  Intelligence  Architecture 


Build  a  scalable 
data  warehouse 
with  a  single 
point  of  control. 


SAS®  provides  a  high-impact,  low-risk  way  to 
achieve  intelligent  data  warehousing.  You  can 
extract,  transform  and  load  data  from  any  source, 
across  any  platform,  while  assuring  quality.  Simplify 
the  way  you  create  and  customize  reports.  And 
deliver  a  shared  version  of  the  truth.  To  find  out 
how  top  companies  reap  bottom-line  rewards 
with  SAS  software-by  leveraging  the  value  of 
data  from  corporate  systems,  e-business  channels, 
the  supply  chain  and  beyond-visit  us  on  the  Web 
or  call  toll  free  1  866  270  5727. 

www.sas.com/warehouse 


The  Power  to  Know® 


SAS  and  all  other  SAS  Institute  Inc.  product  or  service  names  are  registered  trademarks  or  trademarks  of  SAS  Institute  Inc.  in  the  USA  and  other  countries.  ®  indicates  USA  registration. 
©  2003  SAS  Institute  Inc.  All  rights  reserved.  232130US.0503 
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Looted  Art 

Continued  from  Page  1 6 

on  the  scale  carried  out  in  Iraq.  Nonetheless, 
IT  figures  prominently  in  efforts  to  size  up 
and  address  the  damage  to  the  country’s  cul¬ 
tural  heritage — which  includes  its  develop¬ 
ment  of  agriculture  and  the  written  word. 
Topping  the  list:  U.N.  Educational,  Scientific 


The  "Warka  Vase,”  a  centerpiece  of  the  Iraqi 
museum’s  collection,  was  recovered  on  June 
12.  Above,  photos  of  the  vase  before  (left)  and 
the  vase,  now  damaged,  after  its  recovery. 


and  Cultural  Organization  (Unesco)  and 
Interpol,  the  international  police  organiza¬ 
tion,  are  collaborating  on  image  databases 
that  will  archive  the  losses,  starting  with  the 
Iraq  National  Museum  in  Baghdad. 

“Stolen  items  move  on  the  market  to 
potential  buyers  via  images  on  the  Internet,” 
says  Russell.  “The  same  techniques  might 
[make]  images  of  questionable  pieces  avail¬ 
able  to  specialists  who  might  be  able  to  iden¬ 
tify  them  as  [either]  stolen  or  legitimate.” 

Entries  in  the  Unesco  database  will  be 
transferred  via  Web  forms  into  Interpol’s 
main  image  database  of  stolen  art  and  antiq¬ 
uities.  Universities  and  museums  are  also  com¬ 
piling  image  banks  and  lists  of  stolen  items. 

Interpol’s  database  of  stolen  art  has  about 
20,000  images.  Existing  databases  include 
national  records,  such  as  the  FBI’s  National 
Stolen  Art  File,  and  commercial  databases, 
such  as  the  Art  Loss  Register  and  the  Trace 
Stolen  Alert  Network,  which  serve  private 
collectors,  museums,  auction  houses  and 
law  enforcement. 

Lyons,  France-based  Interpol  is  putting 
much  of  its  modest  $7.5  million  annual  IT 
budget  into  upgrading  its  X.400  network  to 
an  IP  virtual  private  network  linking  its  181 
member  states,  says  Peter  Nevitt,  the  director 
of  information  systems.  Interpol  is  also 
replacing  its  text-based  e-mail  search  inter¬ 
face  with  an  image-matching  system.  “A  lot 


of  police  lack  the  language  to  describe  a  gen¬ 
uine  work  of  art,”  Nevitt  explains. 

Although  image  databases  and  VPNs  give 
investigators — and  auction  houses,  dealers 
and  museums — more  information,  items  still 
must  be  reported  stolen,  ownership  estab¬ 
lished,  cross-border  cooperation  authorized 
and  investigations  carried  out.  Digital  pho¬ 
tography  helps  in  identifying  objects,  but 
expert  confirmation  is  typically  required,  and 
such  extra-agency  coordination  takes  time. 

Documented  items  from  museum  and 
private  collections  are  easier  to  recover, 
experts  say,  and  the  IT  tools  can  help. 
Undocumented  items  like  those  looted  from 
archaeological  sites  (and  most  antiquities), 
are  harder  to  recoup  under  U.S.  and  inter¬ 
national  law  because  ownership  can  be  hard 
to  establish  without  a  legitimate  paper  trail. 

Interpol  aims  to  create  what  Nevitt  terms 
a  “Yahoo  of  the  law  enforcement  world,” 
linking  individual  national  crime  databases 
to  Interpol’s,  and  providing  investigators 
with  a  specialized,  secure  meta  search  serv¬ 
ice  analogous  to  Web  search  engines. 

Will  the  database  effort  amount  to  any¬ 
thing?  It’s  impossible  to  predict,  but  recent 
investigations  aided  by  the  London-based 
Art  Loss  Register  have  led  to  the  recovery  of 
works  by  Cezanne  (Pewter  Pitcher  and 
Fruit )  in  1999  and  Keith  Haring  ( Little  Bad 
Wolf)  in  2001.  -Ted  Smalley  Bowen 


E-LEARNING 

The  World’s 
Largest  Classroom 

IT  WASN’T  EXACTLY  smooth  sailing  when  the  IT  department  at  the 
Naval  Education  and  Training  Command  (NETC)  in  Pensacola,  Fla., 
set  out  to  develop  its  e-learning  system,  now  the  nation’s  largest. 
More  than  two  years  ago,  NETC  CIO  Curt  Jones  began  working  on  a 
distance  learning  system  to  serve  1.2  million  people— active  duty 
sailors  and  marines,  plus  reservists,  retirees,  civilian  employees 
and  family  members. 

The  first  order  of  business  was  to  determine  what  the  Navy  could 
feasibly  offer  online.  Web-based  IT  classes  (of  which  NETC  offers 
more  than  950)  were  no-brainers.  Skills  training  such  as  financial 
management,  leadership  and  military-centric  courses  were  trickier. 
The  challenge  was  creating  the  right  blend  of  online  offerings, 

Jones  says.  "We  had  to  look  at  things  and  say,  We  don’t  need  to  do 
all  of  ourtraining  in  brick-and-mortar  schoolhouses,  and  we  don’t 


need  to  do  it  all  on  the  Web.”  In  many  cases,  NETC  used  online 
classes  as  prerequisites  for  classroom  training. 

The  Navy’s  strict  security  firewall  requirements,  which  are  at 
odds  with  the  very  concept  of  distance  learning,  also  posed  a 
challenge.  "That  conflicts  with  this  kind  of  curriculum  where  you 
want  to  use  streaming  video  and  animation  that  could  become  a 
risk  to  the  rest  of  the  community  using  the  network,”  Jones  says. 

His  solution  was  to  build  a  “shadow”  dotcom  site— a  duplicate  of 
the  .mil  site  that  mirrors  the  content  and  also  doubled  the  cost  of 
the  multimillion  dollar  project. 

Since  its  debut  in  May  2001,  the  Navy  e-learning  site  is  averag¬ 
ing  7,500  new  users  each  month.  More  than  100,000  have  regis¬ 
tered  for  the  1,400  courses,  which  are  free  to  eligible  users. 

The  next  step  is  to  connect  the  e-learning  system  to  a  content 
management  system  (CMS)  to  help  sailors  throughout  their 
careers.  The  Navy  is  essentially  creating  multitasking  sailors— a 
project  that  will  help  cut  required  staff  levels  on  Naval  vessels.  “The 
goals  are  to  train  the  individual  and  train  them  in  several  skills, 
instead  of  pipelining  them  into  one  skill  and  saying,  You’re  going  to 
be  a  mess  cook  all  your  life,”  Jones  explains.  “This  CMS  will  help 
them  and  Navy  career  counselors  figure  out  what  are  the  skills  you 
need  to  get  the  job  you  want.”  -Stephanie  Overby 
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See  why  other  companies  have  trusted  us  as  their  partner 
for  customer  and  information  management  solutions. 


You’re  counting  on  your  IT  investments  to  deliver  a  competitive  edge.  But  who  can  you  trust 
to  help  you  deliver? 

Acxiom’s  customer  and  information  management  solutions  have  made  us  a  trusted  partner 
to  some  of  the  largest,  most  respected  companies  in  the  world  -  Nissan  North  America, 
Charles  Schwab  &  Co.,  AT&T,  Sprint,  Federated  Department  Stores,  MGM  MIRAGE  and 
Travelocity  just  to  name  a  few.  They  know  that  Acxiom  provides  the  most  advanced 
customer  information  infrastructure  solutions  available  today. 


Are  you  ready  to  maximize  IT  investments  like  never  before?  To  deliver  the  information 
needed  to  give  your  company  a  competitive  advantage?  Acxiom  is  ready  for  you.  Start  a 
great  relationship  with  Acxiom  today  and  see  what  so  many  other  companies  already  know. 
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Win  a  Ride-Along  at  the  Richard  Petty  Driving  Experience®. 
Visit  www.acxiom.com/petty  to  find  out  how. 
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CRM:  Desperately 
Seeking  Success 

CRM  INITIATIVES  at  many  companies  have  failed.  Yet  according  to  a  recent 
CIO  Magazine  Tech  Poll,  35  percent  of  executives  surveyed  in  May  said 
their  organizations  will  launch  CRM  initiatives  this  year.  Likewise,  a  recent 
IDC  forecast  expects  the  U.S.  market  for  CRM  services  to  grow  at  a 
combined  annual  growth  rate  of  6.7  percent  from  2002  to  2007,  reaching 
$12.1  billion  in  annual  revenue  by  2007. 

But  the  success  rate  of  CRM  initiatives  is  low.  An  AMR  Research  study 
shows  that,  to  date,  only  16  percent  of  CRM  initiatives  have  returned  value. 
The  balance  has  been  unable  to  show  returns  or  failed  outright,  due  in  large 
part  to  companies’  inability  to  define  success  and  goals  for  their  CRM 
projects.  “Companies  must  define  their  CRM  strategy  up  front,  and  that 
strategy  will  define  what  success  looks  like  and  which  metrics  are  important,” 
says  Kevin  Scott,  a  senior  research  analyst  with  AMR  Research. 

For  those  bold  enough  to  move  forward  with  CRM  initiatives,  analysts 
suggest  that  companies  must  embrace  change  at  the  enterprise  level,  and 
have  clear  benchmarks  and  goals  at  the  start,  and  that  collaboration  from 
different  parts  of  the  organization — sales,  marketing  and  IT — is  a  must. 

Most  CRM  Initiatives  Fail 


Best  Practices:  If  You’re  Going 
to  Implement  CRM,  Do  It  Right 

Be  prepared  for  organizational  change.  CRM  requires 
collaboration  across  the  enterprise.  Forrester  Research 
principal  analyst  Bruce  Temkin  recommends  that  compa¬ 
nies  employ  synchronized  deployment— a  practice  that 
links  technology  with  strategy,  people  and  process. 

Keep  it  simple.  Your  CRM  application  will  be  accessed  by 
many  users  with  varying  levels  of  technical  experience.  Make 
sure  your  application  provides  an  easy-to-use  interface. 
Additionally,  select  a  vendor  that  will  work  with  you  post¬ 
implementation  to  provide  training  to  get  users  on  board. 

Align  your  vendor’s  definition  of  success  with  your  own. 

AMR  Research  reports  that  CRM  vendors  define  success  in 
terms  of  the  system  implementation,  while  CIOs  base 
success  on  business  benefits.  Make  sure  your  vendor 
understands  your  definition  of  success. 
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..But  CRM  Goes  On 


25% 

of  companies  surveyed 
implemented  CRM, 

BUT  saw  no  benefit 


12% 

of  companies  surveyed 
implemented  CRM, 

BUT  it  failed  to  go  live 


14% 

of  companies  surveyed 

have  completed  CRM 
implementation 


16%  * 

of  companies  surveyed 
implemented  CRM 

AND  saw  business 
improvement 


^  47% 

~  of  companies  surveyed 
implemented  CRM, 

BUT  it  soon  became 
obsolete 


2% 

of  companies 
surveyed  are 

not  sure 


30%  A 

of  companies 
surveyed  have 
no  plans 


35% 

of  companies 
surveyed  are  in 

the  process  of 
implementing  CRM 


49% 

Implemented  CRM 
or  are  in  process 


51% 

Not  implementing  CRM 


w 

K  19% 

of  companies 
surveyed  put 

CRM  on  hold 


SOURCE:  AMR  RESEARCH  STUDY  "CRM:  INFLICTING  PAIN  OR  PROFIT,"  DECEMBER  2002 
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Companies  everywhere  are  facing  a  new  kind  of  threat. 
Fortunately,  there’s  a  new  level  of  protection. 


MB. 


Introducing  Application  Intelligence  only  from  Check  Point. 


The  Internet  is  evolving.  So  is  the  technology  that  keeps  it  secure.  Now  Check  Point  introduces 
Application  Intelligence— a  major  breakthrough  in  the  evolution  of  Internet  security  and  a  definitive 
response  to  the  growing  problem  of  application  level  attacks.  With  Application  Intelligence  integrated 
into  Check  Point  FireWall-1  and  Smart  Defense,  your  business-critical  systems  are  safe  from  both 
network  and  application  level  attacks.  By  providing  the  world’s  only  truly  integrated  security  infrastructure, 

Check  Point  centralizes  and  strengthens  your  defense  against  attack  at  every  level,  every  location.  Want 
to  take  Internet  security  to  the  next  level?  Get  the  revealing  new  white  paper  that  tells  you  everything 
you  need  to  know  about  the  latest  cyber  threats,  “Internet  Security  Redefined:  A  new  level  of  integration, 
a  new  level  of  protection.”  at  www.checkpoint.com/appint/cio 

We  Secure  the  Internet 


Check  Point 
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A  world  of  IT  solutions. 

Whatever  your  world. 
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Dell  has  a  customized  IT  solution  for  your  business,  no  matter  what  business  you're  in,  or  what  size  it  is. 

From  PowerEdge™  servers  featuring  Intel®  Xeon™  processors  to  PowerVaulf  Storage  and  PowerConnecf  switches, 
Dell  offers  flexible,  high-performance  industry-standard  technologies  and  software  solutions  that  are  just  right  for 
your  particular  business  needs.  And  we'll  help  you  every  step  along  the  way.  Whether  it's  planning  and  design, 
testing  and  validation,  systems  management,  or  our  award-winning  24  x  7  service  and  support,  Dell  will  help  you 
create  an  IT  infrastructure  that's  easy  to  choose,  deploy  and  manage.  So  make  life  easy  on  yourself  and  get  a  big 
advantage  over  your  competition  -  with  a  unique  IT  solution  from  Dell. 


Dell  Rated  #1  in  Intel-Based  Server  Satisfaction 

20  Out  of  21  Consecutive  Quarters 
Technology  Business  Research 
Corporate  IT  Buying  Behavior  and  Customer  Satisfaction  Study 

Fourth  Quarter  2002 
-April  2003 


Call:  M-F  7a-8p  Sat  8a-5p,  CT 

Pricing,  specifications,  availability  and  terms  of  offer  may  change  without  notice.  Taxes  and  shipping  charges  extra,  and  vary  and  not  subject  to  discounts.  U.S.  Dell  Small  Business  new  purchases  only.  Dell  cannot  be  held  responsible  for  errors  in  typography 
or  photography.  'This  device  has  not  been  approved  by  the  Federal  Communications  Commission  for  use  in  a  residential  environment.  This  device  is  not,  and  may  not  be,  offered  for  sale  or  lease,  or  sold  or  leased  for  use  in  a  residential  environment  until  the 
approval  of  the  FCC  has  been  obtained.  Service  may  be  provided  by  third  party.  Technician  will  be  dispatched  following  phone-based  troubleshooting.  Subject  to  parts  availability,  geographical  restrictions  and  terms  of  service  contract.  Service  timing  dependent 
upon  time  of  day  call  placed  to  Dell.  U.S.  only.  'Monthly  payment  based  on  pre-rebate  price  for  48-month  60  Days  Same-As-Cash-QuickLoan  with  46  payments  at  9.99%  interest  rate.  Your  interest  rate  and  monthly  payment  may  be  same  or  higher,  depending 
on  your  creditworthiness.  If  you  do  not  pay  the  balance  within  60  days  of  the  QuickLoan  Commencement  Date  (which  is  five  days  after  product  ships),  interest  will  accrue  during  those  first  60  days  and  a  documentation  fee  may  apply.  OFFER  VARIES  BY 
CREDITWORTHINESS  OF  CUSTOMER  AS  DETERMINED  BY  LENDER  Minimum  transaction  size  of  $500  required.  Maximum  aggregate  financed  amount  for  the  paperless  acceptance  QuickLoan  not  to  exceed  $25,000.  If  your  order  exceeds  S25K,  a  Dell  Financial 


FILE  AND  PRINT  SERVERS 

From  entry-level  servers  to  robust  rack-mountable  solutions  that  fit  existing  infrastructures.  SERVICES 


NEW  PowerEdge™  400SC  Server 

Entry-Level  Value  Server 

•  Intel* *  Celeron®  Processor  at  2GHz 

•  Upgradable  to  Intel  -  Pentium  4  Processor  at  3.20GHz 

•  800MHz  Front  Side  Bus 

•  128MB  266MHz  ECC  DDR  SDRAM  (Up  to  4GB) 

•  40GB  (7200  RPM)  IDE  Hard  Drive 

•  Embedded  Intel®  PRO  Gigabit5 :  NIC 

•  1-Yr  24x7  Dedicated  Server  Phone  Tech  Support 

•  1-Yr  Next  Business  Day  On-Site  Service3 

•  Small  Business  Pricing 


NEW  PowerEdge™  650  Server 

Low-Cost,  General-Purpose  1U  Server 

•  Intel®  Pentium®  4  Processor  at  2.40GHz 

•  Upgradable  to  Intel®  Pentium®  4  Processor  at  3GHz 

•  128MB  266MHz  ECC  DDR  SDRAM 

•  Upgradable  to  3GB  of  Memory 

•  20GB  (7200  RPM)  IDE  Hard  Drive 

•  Upgradable  to  146GB  of  Internal  Hard  Drive  Storage 

•  Intel®  PRO  Gigabit30  NIC 

•  3-Yr  Next  Business  Day  On-Site  Service3 

•  Small  Business  Pricing 


$399 


E-VALUE  Code:  18356-S20803g 


$1199 


as  low  as  $32/mo.,  (46  pmts.30) 

E-VALUE  Code:  18356-S20811g 


Purchase 

•  Dell  offers  a  wide  range  of  reliable,  award-winning 
technology,  all  delivered  from  a  single  point  of 
contact  -  and  our  expert  sales  associates  are 
there  to  help  you  find  the  technology  that's  right  for 
your  business. 

Installation  -  Starting  at  $199 

•  Once  you've  selected  the  right  technology,  Dell  can 
help  you  get  it  up  and  running  quickly  and  cost- 
effectively  with  our  custom  on-site  installation  and 
configuration  services. 


DATABASE  AND  WEB  HOSTING  SERVERS 
Application-specific  servers  that  can  meet  most  any  challenge. 


PowerEdge™  2600  Server 

High-Performance  Tower  Server 

•  Intel®  Xeon”  Processor  at  2.80GHz 

•  Dual  Intel®  Xeon”  Processor  Capable  (Up  to  3.06GHz) 

•  512MB  200MHz  ECC  DDR  SDRAM  (Up  to  6GB) 

•  Upgradable  to  6GB  of  Memory 

•  36GB  (10K  RPM)  Ultra320  SCSI  Hot-Swap  Hard  Drive 

•  Active  ID  Bezel  for  Manageability 

•  3-Yr  Next  Business  Day  On-Site  Service3 

•  Small  Business  Pricing 

^  rnn  as  low  as  $43/mo.,  (46  pmts30) 

V  |  E-VALUE  Code:  18356-S20815 


NEW  PowerEdge™  1750  Server 

1U  High-Performance  Rack  Server 

•  Intel®  Xeon”  Processor  at  2.40GHz 

•  Dual  Intel®  Xeon”  Processor  Capable  (Up  to  3.06GHz) 

•  256MB  266MHz  ECC  DDR  SDRAM  (Up  to  8GB) 

•  36GB  (10K  RPM)  Ultra320  SCSI  Hot-Swap  Hard  Drive 

•  Integrated  Dual-Channel  Ultra320  SCSI  Controller 

•  Active  ID  Front  Bezel  for  Monitoring  System  Health 

•  3-Yr  Next  Business  Day  On-Site  Service3 

•  Small  Business  Pricing 

as  low  as  $46/mo„  (46  pmts30) 

V  |  E-VALUE  Code:  18356-S20816g 


Training  &  Certification  -  Starting  at  $100 

•  After  installation,  Dell  can  help  turn  your  employees 
or  IT  staff  into  experts  on  your  new  technology 
through  a  variety  of  training  and  certification  courses  - 
helping  increase  your  business'  long-term  productivity. 

Service  &  Support 

•  The  support  doesn't  end  at  the  sale.  Dell's  award¬ 
winning  service  and  support  offerings  help  ensure 
that  your  new  network  remains  up  and  running  - 
with  Web,  phone  or  on-site  service3  and  support. 


4-WAY  SERVERS 

Handle  intense  networking  needs  with  ease. 

PowerEdge™  6600/6650  Servers 

Quad  Processing  Power  in  Rack-Mountable  or 
Tower  Form  Factors 

•  Up  to  Four  Intel®  Xeon”  Processors  at  2GHz 

•  Up  to  32GB  DDR200  ECC  SDRAM 

•  Up  to  1752GB  Maximum  Internal  HDD  Storage 

•  Embedded  Ultra  SCSI  Adaptec®  (160MB/s)  Controller 

•  Standard  Hot-Swap  Hard  Drives,  Hot-Swap  Redundant  Fans 
and  Hot-Swap  Redundant  Power  Supplies 

•  10  Hot-Plug  PCI-X  Slots 

ClCl  as  low  as  $148/mo„  (46  pmts?0) 

starting  at  ^  ^3 


NETWORK  SWITCHES 
Design  a  powerful  network  with  scalable, 
high-performance  switches. 

PowerConnect™  2000/3000/5000  Switches 


PowerConnect”  2000  Series  -  Starting  at  $89 

•  Affordable,  Easy-to-lnstal!  Unmanaged  Switches 

PowerConnect”  3000*  Series  -  Starting  at  ^549 

•  Stackable,  Enterprise-Class  Managed  Switches 

•  Advanced  Management  via  Browser  or  Industry-Standard  CLI 

PowerConnect”  5000*  Series  -  Starting  at  s1199 

•  High-Performance,  All-Gigabit  Managed  Switches 

•  Layer-3  Aware  Class  of  Service  Prioritization 


Next  Business  Day  Advanced  Exchanged  Service®  Included 


STORAGE  OPTIONS 
Improve  your  network's  capabilities. 

Dell  PowerVault™  725N  NAS 

Optimized  File  Storage  Across  the  LAN 

•  Intel®  Celeron®  Processor  at  1 ,70GHz 

•  Upgradable  to  Intel®  Pentium®  4  Processor  at  2.60GHz 

•  4x40GB  (160GB)  IDE  Hard  Drives 

•  Up  to  1  Terabyte  of  Internal  Storage  Capacity 

•  Microsoft®  Windows®  Powered  Network  Attached  Storage 

^  as  low  as  $49/mo„  (46  pmts?0) 

'r  |  J  E-VALUE  Code:  18356-S20717n 


Dell  I  EMC 


If  you  have  more  than  300GB  of  storage,  visit  www.dell.com/storage4mybiz 
for  low  prices  on  Dell/EMC  storage  arrays. 


Solutions  that  fit.  Easy  as 


D*LL 


Click  www.dell.com/bizsolutions  Call  1-800-545-9671 


Services  rep  will  contact  you  to  process  your  documentation.  Taxes,  fees  and  shipping  charges  are  extra  and  may  vary.  Not  valid  on  past  orders  or  financing.  QuickLoan  arranged  by  CIT  Bank  to  Small  Business  customers  with 
approved  credit.  “This  term  indicates  compliance  with  IEEE  standard  802.3ab  for  Gigabit  Ethernet,  and  does  not  connote  actual  operating  speed  of  IGB/sec.  For  high-speed  transmission,  connection  to  a  Gigabit  Ethernet  server 
and  network  infrastructure  is  required.  “Technician,  replacement  part  or  unit  (depending  on  service  contract)  will  be  dispatched  if  necessary  following  phone-based  troubleshooting  in  advance  of  receipt  of  returned  defective  unit. 
Service  may  be  provided  by  third-party  provider.  Subject  to  parts  availability,  geographical  restrictions  and  terms  of  service  contract.  Service  timing  dependent  upon  time  of  day  call  placed  to  Dell.  Defective  unit  must  be  returned 
Replacements  may  be  refurbished.  U  S.  only.  Dell,  the  stylized  E  logo,  E-Value,  PowerEdge,  PowerConnect  and  PowerVault  are  trademarks  of  Dell  Computer  Corporation.  Intel,  Intel  Inside,  the  Intel  Inside  logo,  Intel  Xeon,  the  Intel 
Xeon  logo ,  Pentium  and  Celeron  are  trademarks  or  registered  trademarks  of  Intel  Corporation  or  its  subsidiaries  in  the  United  States  and  other  countries.  ©2003  Dell  Computer  Corporation.  All  rights  reserved. 
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Offshore  Debate  Rages 


CIOs  PRESSED  TO  CUT  COSTS  find  that  outsourcing  to  India  makes  economic 
sense.  But  those  decisions  have  effects  that  spread  far  from  the  executive  confer¬ 
ence  rooms.  Online  readers,  ranging  from  jobless  IT  workers  to  Indian  consultants, 
posted  scores  of  comments  reacting  to  our  June  1  story  "Inside  Outsourcing  in 
India.”  Three  examples  follow  (to  see  more,  go  to  www.cio.com/printlinks). 


During  the  '90s  I  enjoyed  working  with 
a  few  Indian  engineers.  That  is  when  we  all 

I  had  employment.  Well,  it  is  indeed 

unfortunate  that  it  has  come  to  this 
because  of  the  greed  and  corruption  we 
have  in  corporate  America.  I  have  a  family 
to  feed  in  America  where  the  cost  of  living 
is  significantly  more  than  in  India,  and 
every  time  I  hearthe  mantra  'We’ll  all  win 
via  outsourcing,'  I’m  more  than  skeptical. 
The  two  winners  are  technologists  in  India 
and  upper  management  in  the  U.S.  The 
losers  will  be  me  and  the  rest  of  the 
middle  class  of  America. 

-YALOSE  (Yet  another  laid-off 
software  engineer) 


Otis’s  David  Wood  says  CIOs  need  a  point 
person  to  manage  outsourcing  relationships. 


I  am  an  Indian  software  professional 
educated  in  India  and  the  United  States. 
Indian  professionals  will  succeed  not  just 
because  they  are  cheaper  but  also 
because  they  are  the  best  (on  average). 
[As]  a  CIO,  would  you  give  work  to  an 
Indian  with  an  Ivy  League  education 
working  in  India  at  $10,000  peryear?  Or 
to  an  American  night  schooler  who 
demands  $70,000  per  year?  According  to 
America,  this  is  supposed  to  be  a  free 
world.  Does  this  mean  free  only  for  the 
West?  Don’t  keep  us  beggars  forever. 

-Ram,  Consultant,  J2MEWorks, 
Chennai,  India 


Our  economy  is  slowly  beginningto 
create  jobs  again.  The  problem  is  that  the 
jobs  are  mostly  overseas.  Our  largest, 
most  profitable  companies  are  shipping 
our  jobs  and  middle  class  income  to  third 
world  countries  where  they  can  get  two  or 
three  workers  for  the  price  of  one.  Econo¬ 
mists  say  this  is  creating  the  largest 
‘jobless  recovery’  in  U.S.  history. 

What  good  is  a  tax  cut  and  lower 
interest  rates  going  to  do  the  United 
States  when  all  of  our  highest  paying  jobs 
are  moving  out  of  the  country?  These  high 
paying  jobs  are  America’s  tax  base. 

-Corey  Goode,  www.goodetech.com 


Offshore  Governance  Dos  and  Don’ts 

DAVID  WOOD,  director  of  systems  development  for  Otis  Elevator,  knows  about  outsourc- 
ingto  India— he’s  got  a  decade  of  experience  under  his  belt  (see  “Inside  Outsourcing  in 
India”  at  www.cio. com/archive/060103).  Below  is  Wood’s  list  of  dos  and  don’ts  for  CIOs 
who  want  to  set  up  a  governance  model  for  monitoring  offshore  vendors.  See  more  of 
Wood’s  comments  in  an  online  forum  with  CIO's  readers  at  www.cio.com/ask. 

Governance  is  a  critical  success  factor  for  offshore  engagements. 


Don’t: 


Do: 

Make  sure  that  there  is  an  executive 
sponsor  for  outsourcing,  usually  the  CIO. 

Assign  responsibility  for  managing  the 
outsourcing  activity,  the  primary  interface 
between  the  vendors  and  your  company. 

Form  a  steering  committee  made  up  of  the 
CIO  and  key  business  executives— and  meet 
regularly.  Review  vendor  metrics,  progress 
and  strategic  directions. 

Make  sure  that  project  governance  is  also  in 
place— typically  managed  by  an  IT  lead  and 
a  business  lead— for  each  project. 


Assume  the  vendor  can  replace  all  mem¬ 
bers  of  your  staff. 

Assume  that  a  vendor  does  not  require  both 
long-term  and  day-to-day  management  and 

direction. 

Assume  that  vendors  will  always  make 
decisions  with  your  best  interests  at  heart. 

Assume  that  the  vendor  needs  to  be  man¬ 
aged  in  an  adversarial  way.  The  vendor 
becomes  an  extension  of  your  team.  Govern 
it  wisely  and  in  many  ways  the  way  you 
would  govern  your  own  employees. 
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We’ve  always  made  your  applications  reliable.  Now  we  make  them  faster,  too. 
VERITAS  acquired  Precise  Software,  the  leader  in  application  performance. 
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On  the  Move 


By  Meridith  Levinson 


Beltway  Turnover 


THE  WAR  ON  TERRORISM  is  being  fought 
on  many  fronts — not  the  least  of  which  are 
in  the  ranks  of  federal  government  CIOs. 
In  July,  CIO  reported  that  the  FBI’s  newest 
and  most  unlikely  recruit,  Darwin  John 
(left),  retired  from  the 
bureau  after  less  than 
one  year  on  the  job  (to 
read  more  about  John, 
see  “The  Unlikeliest  G- 
Man”  at  www.cio.com 
/printlinks).  No  word 
on  a  replacement  at 
this  time. 

The  Axmy  is  transforming  its  IT  leader¬ 
ship.  It  has  eliminated  the  CIO  post  from 
the  Army  Reserve,  according  to  a  report 
in  Federal  Computer  Week.  The  govern¬ 
ment  IT  weekly  quoted  Army  Maj.  Gen. 
John  Scott  as  saying  the  purpose  of  elimi¬ 
nating  the  Reserve’s  CIO  position  is  to 
make  acquiring  and  implementing  IT  more 
efficient.  The  Army’s  CIO,  Maj.  Gen.  Steven 
Bouttelle,  will  take  command  of  IT  for  the 
Reserve  from  the  current  CIO,  Daniel 
Wiener  II. 

Wiener  would  do  well  to  follow  the 
precedent  set  by  other  government  CIOs 
who  have  joined  the  lucrative  consulting 
industry.  Ron  Turner,  who  retired  as  CIO 
of  the  Navy  in  2002,  joined  the  consultancy 
Booz,  Allen  &  Hamilton  last  May.  Also 
that  month,  John  Thomas  Flynn,  the  one¬ 
time  CIO  for  the  states  of  California  and 
Massachusetts,  joined  ICG  Government,  a 
government  technology  consultancy. 

In  other  Beltway  news,  IRS  Commis¬ 
sioner  Mark  W.  Everson  last  May  tapped 
the  agency’s  current  CFO,  W.  Todd  Grams,  to 
lead  IT.  Grams’  appointment  as  CIO  comes 
amid  a  major  reorganization  within  the 
commissioner’s  office.  Grams  will  oversee 
the  agency’s  efforts  to  modernize  informa¬ 
tion  technology,  including  replacing  its 


decades-old  Master  File  system. 

Last,  but  not  least,  the  Department  of 
Homeland  Security  placed  Deputy  CIO 
Laura  Callahan  on  paid  administrative  leave 
last  June  when  questions  about  her  aca¬ 
demic  credentials  surfaced  during  a  Con¬ 
gressional  background  check.  Congressmen 
are  concerned  about  the  validity  of  her  PhD 
in  computer  information  systems  from  the 
unaccredited  Hamilton  University  in 
Evanston,  Wyo.  Callahan  went  to  Home¬ 
land  Security  from  the  Department  of 
Labor  last  April. 

Movin’  On  Up 

There’s  nothing  like  key  retirements  within 
a  company  to  open  growth  opportunities. 
At  Delphi,  Peter  Janak’s  (left)  retirement  as 
CIO  on  July  1,  2003, 
made  room  for  Bette 
Walker  to  move  up  at 
the  automotive  parts 
supplier.  She  was  pro¬ 
moted  from  executive 
director  of  business 
operations  to  vice  pres¬ 
ident  and  CIO,  and 
now  reports  to  Alan  S.  Dawes,  vice  chair¬ 
man  and  CFO. 

Raymond  Smith’s  retirement  as  CIO  of 
Delphi  unit  Delphi  Harrison  Thermal  Sys¬ 
tems  paved  the  way  for  Lynn  Bragg’s  pro¬ 
motion.  Bragg  was  promoted  to  CIO  from 
director  of  development  for  Delphi’s  Vega 
Program.  He  reports  to  Delphi  Thermal 
President  Ronald  M.  Pirtle  and  to  new  Del¬ 
phi  CIO  Walker. 

At  Assurant  Group,  Robert  Lewis  is  now 
executive  vice  president  and  CIO  of  the 
risk  management  product  underwriter. 
Lewis  was  promoted  when  his  boss,  for¬ 
mer  Assurant  CIO  John  B.  Owen,  was 
named  COO  of  the  company. 


When  Albert  Aiello  retired  from  his  post 
as  global  CIO  of  The  Lend  Lease  Corp., 
Jay  Skibinski  moved  in  after  just  seven 
months  on  the  job.  Prior  to  his  promotion, 
Skibinski  was  the  CIO  for  the  Americas 
region. 

Of  course,  retirements  aren’t  the  only 
reason  for  promotions.  Solid  performance 
is  still  one  way  to  get  ahead.  Jennifer  Bolt 
was  promoted  to  senior  vice  president  and 
CIO  of  Franklin  Templeton  Investments 
in  May.  She  previously  served  as  managing 
director  of  Franklin  Templeton  Technolo¬ 
gies  and  as  the  company’s  chief  Web  offi¬ 
cer.  Jess  Reed  has  climbed  his  way  from 
performance  analyst  to  project  analyst  to 
planning  analyst  to  director  of  telecom¬ 
munications  to  assistant  vice  president  to 
vice  president  of  information  services  and 
systems  operations  to  where  he  sits  today 
after  nearly  30  years  of  service — the  office 
of  group  vice  president  and  CIO  of  Geico. 

Finally,  Lucent  Technologies,  which  has 
suffered  financial  losses  amid  its  restruc¬ 
turing  attempts,  shared  some  good  news 
about  its  CIO  with  investors  last  June. 
Ruth  Bruch  (right), 

Lucent’s  senior  vice 
president  and  chief 
information  officer, 
was  appointed  to  the 
board  of  directors  for 
Mellon  Financial.  This 
appointment  recog¬ 
nizes  the  contribution 
she’s  made  to  the  ailing  technology 
company  since  she  joined  it  in  April  2002. 

“Our  commitment  to  recognizing  tech¬ 
nology  as  a  business  line-driven  activity 
begins  at  the  top  with  our  board  of  direc¬ 
tors,”  says  Martin  G.  McGuinn,  chair¬ 
man  and  CEO  of  the  financial  services 
company.  “With  a  strong  background  in 
the  areas  of  technology,  corporate  strat¬ 
egy  and  executive  management,  Ruth 
brings  a  unique  combination  of  talents 
that  will  be  a  tremendous  asset  to  our 
board.” 
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SEVERAL  OF  THE  WORLD’S  LARGEST 
DATA  CENTERS  ARE  AUTOMATING 


OPERATIONS. 


YOU  CAN  T 
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Fast,  precise,  cost  effective  operations.  It’s  here 
Truly  automated  IT. 


Find  out  more  at 


OPSWARE  INC 

Automating  IT” 
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FOLLOW-UP 

American’s 
CIO  Carries  On 

A  YEAR  AGO,  American  Airlines' 
executives  probably  thought  things 
couldn’t  get  much  worse.  They  were 
reeling  from  the  attacks  of  Sept.  11 
and  a  lingering  economic  malaise 
that  was  draining  the  life  out  of  the 
airline  industry. 

Fast-forward  to  2003.  Things 
have  gotten  worse.  American  is 
fighting  desperately  to  stave  off 
bankruptcy,  former  CEO  Don  Carty 
resigned  in  April,  and  the  major 
airlines  continue  to  struggle.  Amid 
this  unprecedented  turbulence,  CIO 
Monte  Ford  and  his  staff  keep  flying. 
Here’s  an  update  on  some  of  the 
major  issues  facing  Ford  since  CIO 
profiled  the  airline  last  year  (see 
"Can  American  Keep  Flying?"  at 
www.cio.com/printlinks). 

IT  budget:  Since  CEO  Gerard 
Arpey  came  on  board,  the  IT  budget 
continues  to  decline,  but  spending 
has  been  much  more  targeted,  says 
Ford.  And  there  is  greater  direction 
from  the  business  units  on  where  to 
focus  money.  “Spending  is  down,  but 
it's  better,”  he  says. 

IT  and  business  relations:  Collaboration  has  also  improved  since 
Arpey’s  arrival.  Every  Tuesday,  AA’s  senior  leadership  team  meets  to 
review  projects,  generate  ideas  and  set  strategy.  “[Arpey]  expects  us  to 
work  together  as  a  team,”  Ford  says.  "That’s  a  pretty  tall  order.  When  you 
run  a  company  as  big  as  AA,  to  function  as  a  team  and  understand 
what’s  going  on  across  the  various  business  units  is  a  tremendous  task.” 

Going  electronic:  Paper  transactions  at  airport  check-in  counters 
have  been  reduced  to  a  minimum.  AA  has  implemented  e-ticketing  with 
more  domestic  carriers  than  any  other  airline;  it  launched  online  check¬ 
in  on  AA.com  last  December,  and  the  self-service  kiosk  rollout  continues 
(there  are  now  more  than  700  in  85  airports).  Internally,  the  IT  staff 
continues  to  enhance  the  company’s  portal,  Jetnet,  which  attracts  some 
30,000  employees  a  day  who  check  benefits,  get  company  news  and 
book  flights.  Ford  is  also  rolling  out  wireless  handhelds  for  flight 
mechanics,  to  expedite  maintenance  and  help  prevent  flight  delays. 

IT  staff  morale:  Ford  says  he's  proud  of  how  his  employees  have  held 
up  in  these  turbulent  times.  When  asked  how  he  keeps  their  morale 
aloft,  he  says,  “I  could  give  you  some  pat  answer  that  sounds  good,  like 
leadership  is  key,  but  it  really  is  a  dedicated,  talented  group  of  people 
who  are  really  self-motivated.”  -Todd  Datz 


Still  flying:  American  Airlines 
CIO  Monte  Ford  continues  to 
pursue  IT  goals  in  a  turbulent 
corporate  climate. 


This  Date  in 

ITHistor 


1996  A  month  that  shall  live  in  infamy— sort  of. 

The  war  of  the  browsers  begins— Microsoft  marches  directly 
into  Netscape  Navigator  territory  with  the  release  of  Internet 
Explorer  3.0  on  Aug.  12.  To  win  overthe  browsing  public, 
Microsoft  includes  free  subscriptions  to  online  services  such 
as  Hollywood  Online  and  The  Wall  Street  Journal.  More  than 
32,000  users  download  the  app  within  the  first  six  hours. 
Netscape  counterattacks  one  week  later  with  Navigator  3.0, 
an  upgrade  of  its  existing  browser  that  previously  held  a  75 
percent  market  share. 

One  day  after  that,  it 
ambushes  the  Red¬ 
mond  juggernaut  by 
publicly  releasing  a 
letter  it  sent  to  the 
Justice  Department 
accusing  Microsoft  of  monopolistic  business  tactics,  including 
shady  incentive  offerings  to  computer  manufacturers  and  ISPs 
in  exchange  for  their  use  of  Explorer.  Microsoft  denies  the 
claims,  but  when  it  goes  to  courtto  answer  to  antitrust 
allegations  in  May  1998,  Netscape's  letter  becomes  a  frame¬ 
work  for  the  prosecution’s  game  plan.  The  battle  of  the 
browsers  rages  on  until  March  1999,  when  America  Online 
acquires  Netscape,  but  Microsoft's  increasing  dominance 
proves  too  fierce  for  the  underdog  Netscape,  which  slowly 
withers  away  until  it  is  swallowed  whole  by  AOL. 


Other  Notable  Events 


Nasdaq’s  e-trading  network 

goes  down  for  34  minutes  in 
1994,  after  a  squirrel  chews 
through  power  lines  outside  a 
data  center  in  Trumbull,  Conn 


2 


Father  of  the  telephone 
Alexander  Graham  Bell  dies 
in  1922.  During  hisfuneral, all 
telephone  traffic  in  the 
United  States  and  Canada  is 
silenced  for  one  minute  in 
Bell’s  honor. 


9 


Netscape’s  IPO  opens  to 
buyers  in  1995  for  $28.  The 
price  peaked  at  $75  per  share 
before  closing  at  $58. 


16 


Compaq  agrees  to  post 
warning  labels  on  its  key¬ 
boards  in  1994,  following  a 


slew  of  lawsuits  from  achy- 
fingered  typists  suffering 
from  repetitive  stress 
syndrome. 


24 


Windows  95  is  released  in 
1995,  and  a  Harry  Potter- 
esque  shopping  frenzy 
ensues.  It  sells  more  than 
1  million  copies  in  four  days. 


30 


The  first  computer  to  serve 
as  the  backbone  for  the 
Arpanet  is  shipped  to  the 
University  of  California  in 
1969.  This  is  the  first  stake  in 
the  ground  in  what  eventually 
becomes  the  Internet. 

-Daniel  J.  Horgan 


SOURCES:  Canada's  Digital 
Collection,  History  Channel, 
New  Zealand  NetGuide, 
University  of  Surrey. 
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The  meeting's  behind  her.  The  order's  in  her  hands.  Now  Sophie's  real  work 
begins.  First  priority,  access  critical  inventory  data  in  her  supply  network. 
Equipped  with  Nortel  Networks  Wireless  LAN  technology,  she  can  securely 
tunnel  to  her  company’s  private  network  from  the  airport  lounge.  The 
product's  rolling.  At  Nortel  Networks,  we  make  all  this  reality  by  bridging  the 
gaps  to  seamless  customer  experience.  Drawing  on  unparalleled  expertise  that 
spans  wireless  and  wireline  environments  to  extend  continuous  encrypted 
connectivity  between  public  and  private  networks.  Giving  enterprises  ever 
more  powerful  tools  to  outperform  their  competition  at  every  stage  of  the 
sales  process.  Yes,  the  tools  to  succeed.  Success  because  mobile  workers 
like  Sophie  can  operate  from  any  WI-FI  hot  spot  as  if  they  were  back  in  their 
offices.  Always  on.  Always  productive.  Always  first  to  deliver  the  goods. 
Secure  mobility.  Just  another  way  Nortel  Networks  is  removing  boundaries 
to  business.  nortelnetworks.com/WLANinfo 
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Nortel  Networks,  the  Nortel  Networks  logo  and  the  Globemark  are  trademarks  of  Nortel  Networks.  ©  2003  Nortel  Networks.  All  rights  reserved. 
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Michael  Schrage  I  Making  IT  Work 


It’s  All  About  the  Execution 


Why  IT 

Really  Does 

Matter 

Businesses  can  indeed  differentiate 
themselves  through  IT.  It’s  all  a  question 
of  how  they  manage  the  technology. 

THE  HARVARD  BUSINESS  REVIEW  is  not  famous  for  publishing  satire. 

Then  again,  when  a  clever  writer  pushes  a  clever  idea  well  beyond 
the  point  of  diminishing  returns,  the  result  can  read  like  parody 
from  the  pages  of  The  Harvard  Lampoon.  You’re  not  quite  cer¬ 
tain  whether  you  should  sagely  nod  or  burst  out  laughing. 

Nicholas  Carr’s  controversial  article  “IT  Doesn’t  Matter” 
presents  a  brilliant  example  of  this  rare  genre.  Ever  since  its 
May  publication,  his  thesis  has  provoked  heated  debate  both  in 
tech  circles  and  the  realms  of  senior  management.  Much  of  the 
debate  has  been  of  the  “IT  does  too  matter!!!”  variety,  but 
Carr’s  seriocomic  screed  deserves  a  rigorous  dissection  because 
he’s  clearly  struck  a  nerve  as  well  as  a  funny  bone. 

Carr’s  narrative  deserves  to  be  read  as  an  intriguing  techni¬ 
cal  argument  in  the  service  of  grotesquely  naive  business 
assumptions.  His  facts  may  be  flawless  and  his  historical  analy¬ 
sis  smooth.  But  the  business  conclusions  he  draws  are  pro¬ 
foundly  silly.  CIOs  had  better  understand  why,  because  they 
may  report  to  intellectually  lazy  CEOs  and  CFOs  who  actually 
believe  that  the  Harvard  Business  Review  is  giving  its  impri¬ 
matur  to  a  powerful  argument  when,  in  reality,  it  is  cleverly 


overhyping  a  clever  little  idea.  Caveat  lector! 

So  let’s  cut  to  the  heart  of  Carr’s  case:  “What  makes  a  resource 
truly  strategic — what  gives  it  the  capacity  to  be  the  basis  for  a 
sustained  competitive  advantage — is  not  ubiquity  but  scarcity. 

You  only  gain  an  edge  over  rivals  by  having  or  doing  something 
that  they  can’t  have  or  do.  By  now,  the  core  functions  of  IT.. .have 
become  available  to  all.  Their  very  power  and  presence  have  begun 
to  transform  them  from  potentially  strategic  resources  into  com¬ 
modity  factors  of  production.  They  are  becoming  costs  of  doing  5 
business  that  must  be  paid  by  all  but  provide  distinction  to  none.”  “ 
Excuse  me?  Who  says  that  resource  scarcity  is  the  key  to  | 
strategy?  Why  on  earth  is  resource  ubiquity  inherently  the  low  3 
road  to  commodity?  That  sort  of  glib  analysis  gives  Econ  101  “ 

O 

a  bad  name.  In  fact,  it’s  shockingly  easy  to  show  there  is  virtu-  5 

CT 

ally  zero  correlation  between  the  availability  of  a  commodity  S 
and  its  effective  role  as  a  so-called  “strategic”  resource. 


30  CIO  AUGUST  1,  2003 


www.cio.com 


wmM 


Questions  are  everywhere.  Insight  is  not.  Making  important  decisions  is  your  job.  Delivering  the  insight  to 
help  you  make  smarter  decisions  is  ours.  With  business  applications  and  services  like  financial  and  customer 
relationship  management,  we  have  the  experience  and  resources  to  help  you  succeed  in  a  world  of  surprises. 
To  learn  more,  visit  microsoft.com/BusinessSolutions/lnsight  Software  for  the  Agile  Business. 


Microsoft 
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far  less  than  the  quantity  of  the  commodity.  The  more  persua¬ 
sive  argument  is  that  the  quality  of  IT  management  matters 
even  more  as  the  IT  commodity  becomes  ubiquitous. 

Carr  insists  at  great  length  that  the  quality  of  management 
doesn’t  matter  because  IT  is  really  an  “infrastructure”  technol¬ 
ogy  like  electricity,  the  steam  engine  and  the  internal  combustion 
engine.  IT,  he  argues,  ultimately  devolves  into  commoditized 
ubiquity,  like  lightbulbs  and  telephones.  Infrastructure  tech¬ 
nologies — as  opposed  to  proprietary  technologies — inherently 
preclude  opportunity  for  sustainable  competitive  advantage. 

But  why  should  IT  be  treated  more  like  electricity  and  auto¬ 
mobile  engines  than  such  media  as  telephones  and  television? 
Don’t  companies  creatively  use  call  centers  and  television  adver¬ 
tisements  to  cost-effectively  manage  customer  interaction  and 

build  brand  equity?  Would  Carr  suggest 
that  Coca-Cola  treat  television  adver- 

Capital  is  a  commodity,  right?  Would  Harvard  Business  tisements  as  comm<xl,ties?  should  De" 

treat  its  call  centers  as  commodities? 

Review  publish  “Capital  Doesn’t  Matter”? 


Consider  this  thought  experiment:  Three  companies  bitterly 
compete  against  each  other  for  market  share  and  profit — for 
example,  FedEx,  DHL  and  UPS;  or  Nike,  Reebok  and  Adidas; 
or  American  Airlines,  Southwest  Airlines  and  JetBlue  Airways. 
Give  them  each  $100  million.  No  strings  attached. 

So  will  these  companies  be  equally  better  off  in  their  rivalry 
with  each  other  because  they  each  have  $100  million  to  invest? 
Of  course  not.  Some  of  the  companies  will  enjoy  significantly 
greater  returns  on  their  free  $100  million  investment  than  the 
others.  Capital  is  a  commodity,  right?  Yet  somehow  we  con¬ 
sistently  see  enormous  disparities  within  industries  in  their 
return  on  capital.  We  could  keep  feeding  these  companies  free 
capital  and  the  disparities  would  persist.  Would  Harvard  Busi¬ 
ness  Review  publish  “Capital  Doesn’t  Matter”? 


Suppose,  instead,  we  offer  these  business  rivals  equal  access  to 
the  very  best  and  very  brightest  graduates  from  Harvard,  Berke¬ 
ley,  Stanford  and  MIT.  Should  we  rightly  expect  each  and  every 
company  to  get  comparable  value  from  this  incredibly  rich  tal¬ 
ent  pool?  Or  does  reality — and  bitter  experience — dictate  that 
some  companies  will  manage  to  get  incredible  performance  from 
truly  mediocre  talents  while  others  will  blithely  waste  the  time, 
effort  and  energy  of  their  most  gifted  hires?  Perhaps  Harvard 
Business  Review  should  print  “Talent  Doesn’t  Matter.” 

Now  let’s  give  every  single  employee  of  every  single  com¬ 
pany  his  very  own  free  Wi-Fi-ed  Linux  laptop,  PDA  and  cell 
phone  along  with  all  the  training  and  technical  support  he 
needs.  Free.  Does  anybody  in  their  right  mind  believe  that  this 
huge  endowment  in  personal  technological  capacity  will  equally 
lift  the  productivity  and  profitability  of  these  competitors? 

Those  three  simple  thought  experiments  affirm  an  undeniable 
truth:  It’s  not  free  and  easy  access  to  a  commodity  that  deter¬ 
mines  its  strategic  economic  value  to  the  company;  it  is  the 
way  that  commodity  is  managed  that  determines  its  impact. 
Management  matters.  The  idea  that  companies  can  divorce 
their  resources — no  matter  how  cheap,  powerful  and  ubiqui¬ 
tous — from  the  act  of  managing 
them  is  patently  absurd. 

This  should  come  as  no  surprise 
to  any  serious  reader  of,  say,  CIO 
magazine  or  even  Harvard  Busi¬ 
ness  Review.  Yet  the  very  premise 
of  “IT  Doesn’t  Matter”  is  that  the 
quality  of  management  matters 


Add  a  Comment 


Has  IT  lost  its  strategic  importance 
because  it's  too  ubiquitous?  Or  do  IT's 
business  benefits  outweigh  its  costs? 
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In  truth,  IT  is  more  a  suite  of  tech¬ 
niques  than  an  arsenal  of  technologies. 
So  why  does  Carr  compare  IT  to  the 
way  power  utilities  are  organized  instead  of,  say,  the  way  fac¬ 
tories  are  organized?  Why  not  IT  as  the  “flexible  information 
factory”  instead  of  the  ubiquitous  information  utility?  Com¬ 
puter  Numerically  Controlled  machine  tools  should  be  seen  as 
a  manufacturing  medium.  Does  the  commoditization  of 
machine  tools  mean  that  “Manufacturing  Doesn’t  Matter”? 

Let  me  offer  one  plausible  hypothesis:  Comparing  IT  to  a  fac¬ 
tory  instead  of  a  utility  would  undermine  Carr’s  thesis.  Why? 
Because  the  future  design  of  factories  does  matter  to  the  future 
of  business  innovation  and  competitiveness.  In  other  words, 
Carr  clings  to  the  “commodity  infrastructure”  assertion  not 
because  the  weight  of  evidence  supports  it  but  because  it  is  a 
framework  that  supports  his  case. 

The  real  issue  is  whether  IT’s  business  benefits  unambigu¬ 
ously  outweigh  its  costs.  Carr  argues,  rightly,  that  too  many 
businesses  have  spent  too  much  money  on  IT  with  too  little  to 
show  for  it.  Then  again,  a  lot  of  companies  have  lost  money 
using  derivatives  as  a  tool  to  manage  currency  risk. 

What  Carr  fails  to  recognize  is  that  IT  can  profoundly  trans¬ 
form  the  economics  of  innovation,  segmentation  and  differenti¬ 
ation  for  most  businesses.  And  in  that  recognition  lies  the  CIO’s 
ultimate  opportunity.  I  bet  Carr  knows  this.  But  it’s  always  eas¬ 
ier  to  be  provocative  than  do  the  hard  work  of  turning  com¬ 
modity  technologies  into  value-added  business 
products.  QEI 

Michael  Schrage  is  codirector  of  the  MIT  Media  Lab’s 
eMarkets  Initiative.  He  can  be  reached  via  e-mail  at 
schrage@media.mit.edu. 
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All  those  who  want 


_ 


more  wireless 
with  less  worry 


•  •• 


Say 


I 


Technology  Risk 


Wireless  networks  offer  businesses  several  advantages.  Increased 
mobility,  design  flexibility,  lower  costs.  But  as  with  most  new 
technologies,  design  focuses  on  functionality  -  not  risk. 
Wireless  technologies  do  not  have  the  physical  access 
restrictions  used  in  traditional  wired  environments.  They  make 
it  possible  for  someone  in  the  lobby  or  across  the  street  to  have 
access  to  a  network  carrying  patient  or  employee  information, 
sensitive  corporate  data,  or  trade  secrets. 

Are  your  wireless  access  points  configured  with  adequate 
security?  Has  your  business  taken  steps  to  prevent  hackers 
from  exploiting  your  information?  Do  you  know  your 
vulnerabilities?  “War  driving.”  “Net  stumbling.”  “War  chalking.” 
“LAN  jacking.”  From  wireless  to  business  continuity, 
infrastructure  management  to  security  and  privacy,  Protiviti 
helps  you  identify,  measure  and  manage  the  technology  risks 
that  threaten  your  business  objectives.  That  way,  you  can 
manage  your  risks,  not  just  react  to  them. 


Protiviti  is  the  leader  in  independent  risk  consulting  and 
internal  audit  services.  We  provide  international  services  for 
established  and  emerging  companies  to  help  them  inde¬ 
pendently  identify,  measure  and  better  manage  risk.  Our  Big 
Four  experience  ensures  years  of  expertise  in  a  wide  range  of 
industries.  So  whether  your  challenge  is  reporting  accurate 
results,  maximizing  the  value  of  technology  or  adopting 
business  controls  you  can  trust,  Protiviti  delivers  quantifiable 
solutions  that  make  a  difference...  Are  you  ready  to  Say  i? 

For  more  information  visit  protiviti.com  or  call 
1.888.556.7420. 


^  Visit  KnowledgeLeader.com  today  for  a  free  30-day  trial. 

sf  KnowledgeLeader.com  provides  exclusive  tools,  resources  and 
best  practices  to  help  internal  auditors  and  risk  professionals. 


©  2003  Protiviti  Inc.  EOE 


Business  Risk 


Technology  Risk 


Internal  Audit 


Tom  Davenport  I  The  New  Work  Order 

Retooling  the  Knowledge  Worker 


Serenity  Now! 

If  businesses  don’t  find  a  way  to  help  the  knowledge 
worker  manage  information  technology,  today’s 
confusion  will  lead  to  tomorrow’s  insanity 

SOLVING  THE  PROBLEMS  of  knowledge  worker  productivity  and  per¬ 
formance  is  a  daunting  prospect,  so  it  makes  sense  to  start  with 
the  most  simplistic  approach  to  research  I  know — study¬ 
ing... me.  I’ve  been  known  to  develop  enormous  insights  about 
others  just  by  looking  at  my  own  problems  and  approaches. 
And,  as  any  good  Buddhist  will  tell  you,  observing  oneself  is  the 
path  to  enlightenment.  I’m  not  a  Buddhist,  mind  you,  but  that’s 
OK  since  my  aims  are  more  modest  than  enlightenment:  I’m 
only  shooting  for  a  little  sanity. 

Like  everybody  else  these  days,  I’m  feeling  a  bit  overwhelmed 
by  my  own  personal  information  and  knowledge  environment. 
I  have  lots  of  electronic  devices — it  seems  like  a  lot  to  me,  any¬ 
way.  For  these  purposes,  I’m  intentionally  ignoring  the  devices 
my  family  uses,  for  which  I  am  the  first-line  (if  somewhat  reluc¬ 
tant  and  ineffective)  provider  of  technical  support.  For  my  own 
use,  I  have  a  desktop  PC  at  home,  a  laptop  PC  that  travels 
with  me,  a  PDA  and  a  typical  cell  phone.  None  of  them  com¬ 
municates  very  well  with  each  other  (though  my  PDA,  for 
example,  communicates  reasonably  well  with  my  wife’s  and 
my  assistant’s  PCs),  and  I  occasionally  have  to  send  e-mails 


from  one  device  to  another  as  if  they  were  distant  cousins.  I 
know  they  could  be  made  to  communicate  better  with  each 
other,  but  I  don’t  have  time  to  figure  it  out,  and  frankly  I  am 
grateful  if  they  are  all  just  working. 

E-mail  has  become  the  core  of  my  information  flow,  but  I  get 
too  much  of  it.  I  have  four  addresses,  which  get  forwarded 
into  two  different  e-mail  clients.  I  know  that  isn’t  ideal,  but  if 
you  work  with  multiple  organizations,  you  tend  to  have  mul¬ 
tiple  e-mail  identities.  A  couple  of  those  identities  I  access  only 
at  home,  which  makes  my  response  time  to  them  slow,  but  it 
keeps  me  sane. 

Today  I  got  72  e-mails  through  one  account  and  29  through 
another,  for  a  total  of  101.  About  a  third  (a  much  higher  frac¬ 
tion  on  weekends)  were  from  spammers,  which  I  am  coming  to 
believe  are  the  lowest  form  of  life  on  the  planet.  I  sent  out  32 
messages  during  the  day.  I  did  all  this  through  a  broadband 
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We  see  management 
a  little  differently 
from  the  other  guys. 


At  NetlQ,  we  don't  see  a  problem.  Only  solutions. 
Managing  your  Windows  server  environment  is  easier 
than  ever  with  Microsoft  Operations  Manager.  And, 
as  a  key  Microsoft  partner,  NetlQ  extends  Microsoft 
Operations  Manager  to  manage  and  secure  your 
entire  enterprise,  whether  you're  driving  UNIX, 
NetWare,  Linux,  Windows. ..or  all  of  them.  NetlQ. 
We're  the  management  people.  And  nobody  does 
management  smarter.  Nobody. 


CIO  eBook!  Get  your  free  copy  of  From  Chaos  to  Control: 
The  CIO's  Executive  Guide  to  Managing  and  Securing 
the  Enterprise,  www.netiq.com/manageability, 
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connection  in  my  hotel — pretty  cool — and  it  only  cost  me 
$12.95  and  the  hour  I  wasted  trying  to  get  connected  to  it.  I 
finally  called  the  front  desk  for  help,  and  the  attendant  told 
me  that  it  wasn’t  working  but  I  should  keep  wasting  my  time 
trying  to  connect  because  it  would  probably  be  working  soon. 

Then  there’s  my  inbox,  in  which  I  have  1,716  messages.  You 
may  find  that  scandalous,  but  it  works  pretty  well  for  me.  I’ve 
basically  created  one  big  filing  cabinet  for  stuff  I  might  need 
later.  I  delete  about  two-thirds  of  my  messages  on  any  given  day, 
and  the  other  third  slowly  drift  up  the  screen.  Every  so  often  I 


I’ve  got  too  many  devices.  Keeping  them  in  sync  takes 
too  much  time.  Unfortunately,  this  problem  is  only 
going  to  get  worse— for  me  and  for  the  world  at  large. 


delete  a  couple  hundred  old  e-mails.  I  recently  attended  a  time 
management  class  in  which  the  instructor  suggested  emptying 
your  inbox  every  day,  but  I  found  that  ludicrous.  Maybe  I’m 
just  undisciplined,  but  I  find  I  have  to  think  about  a  lot  of  the 
e-mails  I  get — or  solicit  a  response  from  someone  else — before 
I  can  answer  them. 

I  also  get  lots  of  voice  mails  in  my  three  mailboxes — a  total 
of  22  in  today’s  queue  (in  part  because  I  didn’t  get  around  to 
checking  them  yesterday).  1  don’t  like  voice  mail  very  much,  and 
I  try  not  to  listen  to  my  messages  on  my  cell  phone  while  driv¬ 
ing  anymore  because  I’m  tempted  to  write  things  down  in  order 
to  respond — particularly  difficult  in  the  car.  I  hope  voice  mail 
goes  away  soon  or  gets  merged  with  e-mail.  If  you  want  to 
make  my  day,  call  me  and  hang  up.  Being  able  to  delete  a  blank 
voice  message  seems  a  considerable  accomplishment. 

I  have  consciously  chosen  not  to  add  certain  tools  and  tech¬ 
nologies  to  my  information  environment.  I  don’t  do  IM,  for 
example.  I  used  it  for  a  while,  and  I  didn’t  like  having  my  atten¬ 
tion  held  hostage  by  anyone  who  felt  like  sending  me  a  message. 
I  also  don’t  have  any  interest  in  wireless  e-mail.  I  can’t  remem¬ 
ber  any  e-mail  that  was  so  important  that  I  needed  to  read  it  in 
a  taxi.  And  I  don’t  blog  or  read  others’  blogs — although  one 
might  wonder  exactly  how  this  rambling  column  differs  from 
a  blog  other  than  being  in  print. 

Once,  at  a  time  management  course,  the  instructor  advised 
making  my  PDA  the  center  of  my  digital  life.  I  tried  for  a  day  to 
use  it  for  “to-do”  lists  and  so  on,  but  I  couldn’t  get  used  to  it. 
Instead,  I  would  write  phone  messages  on  any  paper  I  could  find, 
but  not  surprisingly,  I  lost  a  lot  of  them.  So  now  I  restrict  myself 
to  one  notebook  at  a  time.  The  only  problem  with  that  is  that  I 
consider  it  too  important  to  waste  on  to-do  lists  and  phone  num¬ 
bers,  so  I  still  write  those  on  scraps  and  promptly  lose  them. 


The  Roots  of  My  Informational  Problems 

At  best  I  consider  myself  only  fair  at  managing  my  personal 
information  and  knowledge  environment.  Where  do  I  go 
astray?  I  think  about  that  a  lot,  and  I  have  a  few  hypotheses. 

First,  I’ve  got  too  many  devices.  Keeping  them  in  sync  would 
simply  take  too  much  time.  Unfortunately,  this  problem  is  only 
going  to  get  worse — for  me  and  for  the  world  at  large.  I  was 
at  a  conference  recently  where  all  these  technologists  kept 
telling  me  that  intelligent  machines  already  outnumber  humans 
10-to-l,  and  they  are  growing  at  a  much  faster  rate  than  we  will. 

Of  course,  the  technologists  are  saying 
that  these  devices  will  all  be  seamlessly 
linked,  but  I  know  better. 

My  second  problem  is  that  I  don’t 
seem  to  get  much  help  from  my  organi¬ 
zations.  There  is  some  assistance  avail¬ 
able  for  the  use  of  each  particular  tool 
(except  for  PDAs,  home  computers  and 
networks),  but  the  support  is  fragmented.  I  don’t  really  blame 
them  because  no  organization  seems  to  do  this  well,  and  I’m  not 
sure  anyone  really  knows  the  key  to  personal  information  effec¬ 
tiveness.  I  do  believe  that  a  substantial  amount  of  business 
advantage  in  the  future  will  come  from  making  workers  more 
effective  and  productive  in  the  use  of  all  this  stuff,  so  more 
resources  ought  to  be  injected  into  assisting  us  poor  sods. 

I’ve  already  suggested  that  technology  doesn’t  work  well 
enough.  Too  many  things  break;  too  much  software  has  bugs; 
too  many  features  don’t  function.  Somebody  once  said  that 
technology  is  “anything  that  doesn’t  work  very  well  yet,”  and 
by  that  definition  we’re  employing  lots  of  technology. 

After  blaming  everyone  else,  let  me  also  blame  myself.  I, 
like  most  people,  underinvest  in  my  own  information  envi¬ 
ronment.  For  some  reason  I  have  a  neurotic  fear  of  spending 
too  much  time  on  personal  organization.  I’d  much  rather  write 
an  article  or  book  chapter  or  even  an  e-mail  than  write  down 
an  address  or  an  appointment.  On  an  airplane,  I’d  read  10 
books  or  newspapers  before  cleaning  up  my  to-do  list.  At  least 
I  know  my  preferences — and  I’m  willing  to  live  with  the  neg¬ 
ative  repercussions. 

So  there  you  have  it — a  sad  tale  of  a  knowledge  worker’s 
informational  peccadilloes.  To  all  you  vendors  out  there,  I’d 
pay  a  lot  of  money  to  anybody  who  could  change  my  life  with¬ 
out  too  much  personal  sacrifice.  And  to  all  you  employers  of 
people  like  me,  throw  us  a  lifeline — as  soon  as  you  can  figure 
out  what  it  is!  HE! 


Tom  Davenport  is  director  of  the  Accenture  Institute 
for  Strategic  Change  and  professor  of  IT  and  manage¬ 
ment  at  Babson  College.  You  can  reach  him  at 
tdavenport@babson.  edu. 
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Profitability  thresholds  and 
the  feasibility  of  toast. 


Can  you  see  it? 


Kris  Pederson,  practice  leader,  communications  industry 


You  push  a  button,  you  get  toast.  Easy.  But  only  because  you  don’t  have  to 
build  the  hydroelectric  dam  that  furnishes  the  few  watts  it  takes  to  make  toast. 

Now  imagine  that  you  are  a  telecom  company,  for  example,  looking  hard  at  a 
lot  of  brilliant  service  offerings  that  defy  feasibility  because  revenues  just 
won’t  beat  costs  unless  you  sign  up  millions  of  customers.  Which  isn’t  likely. 
This  is  where  on  demand  business  comes  in.  Where  the  infeasible  can 
become  profitable  because  new  thinking  trumps  old. 

You  look  again  at  your  fixed  costs  —  everything  from  models  to  processes 
to  infrastructure.  Could  they  be  outsourced?  Are  there  any  bits  of  your  cost 
structure  that  aren’t  core  competencies?  If  so,  whose  core  competencies 
are  they?  No  stone  is  left  unturned. 

Soon,  you’re  out  of  the  hydroelectric  dam  business,  focused  on  telecom 
offerings,  and  making  toast  like  there’s  no  tomorrow. 

On  demand  business 
starts  with  on  demand  thinking. 

Real  people  with  real  insights  and  the  resources  to  deliver  on  them.  Partners, 
listeners,  problem  solvers.  Doers.  People  to  help  you  evolve  your  thinking, 
your  business  and  your  culture.  It  won’t  happen  overnight.  It  will,  however, 
create  real  change  in  your  company.  On  demand  business.  Get  there  with 
on  demand  people.  Please  call  800  IBM  7080  (ask  for  thinking)  or  visit 
ibm.com/services/thinking 


3M  and  the  IBM  logo  are  trademarks  or  registered  trademarks  of  International  Business  Machines  Corporation  in  the  United  States  and/or  other  countries.  ©2003  IBM  Corp.  All  rights  reserved. 
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Are  you  putting  on  a  little  weight? 

Do  you  think  no  one  understands  you? 

Do  you  feel  out  of  control? 

Of  course  you  do. 

Why  should  you  be  different  from  any  other  CIO? 

Here’s  why  you  need  to  stop, 
take  a  look  around  and  change  your  ways. 

BY  CHRISTOPHER  KOCH 
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FOR  SEVEN  YEARS,  Joe Gagliardi,  a  programming  manager  for  Southeast  Frozen 
Foods,  worked  in  what  felt  like  a  sick  ward. 

Everybody  was  constantly  ill,  though  Gagliardi  fared  better  than  most.  “There  were 
always  colds,  sneezing,  temperatures  and  a  lot  of  sick  days,’  he  says. 

The  programmers  worked  in  a  separate  building  (no,  not  a  freezer)  so  some  became 
convinced  that  it  must  be  the  building  making  them  sick.  What  else  would  explain  it? 

A  programmer  called  the  Centers  for  Disease  Control  and  Prevention,  and  eventually 
the  company  hired  some  environmental  consultants  to  investigate. 

The  consultants  came.  They  sampled  the  air  and  the  water,  looking  for  poisons  and 
pollutants.  They  sniffed  the  rugs  and  peered  into  the  air-conditioning  ducts,  looking  for 
viruses  and  bugs. 

They  didn’t  find  anything. 

Five  and  a  half  years  ago,  Gagliardi  left  that  job 
to  become  CIO  of  Unisa,  a  distributor  of 
womens  shoes  and  accessories. 

And  he  got  better. 

So  maybe  the  consultants  had  missed  something. 

Or  maybe  all  the  coughing  and  sneezing  and  fevers 
had  something  to  do  with  the  fact  that  Gagliardi  and 
his  fellow  programmers  regularly  worked  long 
weeks  and  12-hour  days.  Most  of  Gagliardi s  colleagues 
eventually  quit,  until  it  was  just  him  and  a  woman  who 

started  the  same  time  he  did. 

As  he’s  talking  about  this,  Gagliardi 
has  an  epiphany.  “My  God,’’  he  says. 

“I  realize  now  that  that’s  why  we  were  sick  all  the  time. 

“It  was  the  stress. 


Reader  ROI 

►  The  science  behind  stress 

►  Why  the  CIO  job  is 
singularly  stressful 

►  Strategies  for  coping  with 


executive  stress 
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The  Stress  Epidemic 

Only  in  the  past  20  years  or  so 
has  science  arrived  at  the  same 
conclusion  as  Gagliardi.  The 

New  England  Journal  of  Medi¬ 
cine  in  1 998  went  so  far  as  to 
declare  that  “managing  the 
long-term  effects  of  the  physio¬ 
logical  responses  to  stress  is 
critical  to  survival.”  Stress  may 

the  threat  of  terrorism,  most 
Americans  report  feeling  more 
stress  today.  It’s  even  worse  for 
executives. 

Constant  stress  does  more 
than  damage  your  health.  It 
destroys  your  judgement  and 
distorts  your  decision-making 
process.  Constant  stress  has 
been  shown  to  shrink  the  hip- 

CIOs  have  a  vast  amount  of  responsibility  but 
little  authority  for  controlling  outcomes.  This  is 
what  psychologists  call  low  decision  latitude. 

And  according  to  a  1997  study,  executives  with 
low  decision  latitude  saw  their  risk  of  illness 
increase  anywhere  from  30  to  1,700  percent. 

contribute  to  85  percent  of  all 
medical  problems,  says  Connie 
Tyne,  executive  director  of  the 
Cooper  Wellness  Program  in 
Dallas,  which  counsels  execu¬ 
tives  on  stress  reduction.  Fifty- 
two  percent  of  executives  will 

pocampus,  a  region  of  the  brain 
that  controls  memory  and  con¬ 
centration.  “We  all  know  anec¬ 
dotally  that  when  someone  is 
under  stress  they  don’t  have  the 
clearest  vision,”  says  Tyne. 

“They  don’t  have  the  patience 

to  work  through  a  complicated 
decision.  They  will  have  a  ten¬ 
dency  to  abdicate  or  jump  into 
a  decision  prematurely.” 

CIOs  don’t  like  to  talk  about 
how  stress  affects  them.  They 
are  taught  that  stress  is  to  be 
accepted,  swallowed  whole 
and  its  effects  ignored.  Admit¬ 
ting  to,  or  worse,  displaying 
stress  is  a  sign  of  weakness,  an 
admission  of  failure.  Unfortu¬ 
nately  for  CIOs,  this  belief  is 
widely  shared,  at  least  at  work. 

“You  have  to  carry  off  the 
position  with  dignity  and  a 
show  of  strength  in  public,” 
says  Jim  Quick,  professor  of 
organizational  behavior  at  the 
University  of  Texas  at  Arling¬ 
ton.  “You  have  to  reflect  the 
strength  and  power  of  the 
organization  even  if  as  an  indi¬ 
vidual  you’re  feeling  somewhat 
vulnerable.” 

This  means  that  CIOs  need 
to  deal  with  stress  on  their 


die  of  diseases  related  to  stress, 
according  to  Tyne.  That’s 
partly  because  stress  affects 
nearly  every  major  system  in 
our  bodies,  creating  a  laundry 
list  of  health  problems — 
among  them  diabetes,  high 
blood  pressure,  stroke,  aller¬ 
gies,  asthma  and  colitis. 

The  clearest  sign  that  there’s 
a  stress  epidemic  can  be  seen  in 
heart  disease  statistics.  For 
example,  a  recent  study  found 
that  people  who  get  less  than 
five  hours  of  sleep  twice  a  week 
or  more  are  300  percent  more 
susceptible  to  heart  attacks. 
Their  overall  rate  of  developing 
heart  disease  doubles. 

Not  surprising,  stress  has 
been  on  the  rise  in  the  past  few 
years.  With  the  economy  gone 
bad,  unemployment  rising  and 


FOR  CIOS  IN  DENIAL 


12  Warning  Signs 
That  You’re  Stressed  Out 


1.  Your  stomach  hurts;  your  head  aches;  you  catch  colds  frequently. 

2.  You  feel  emotionally  numb. 

3.  You  snap  at  people:  colleagues,  your  spouse,  your  kids. 

4.  People  tell  you  they're  worried  about  you. 

5.  You  feel  that  if  you  take  on  one  more  task,  you’re  going  to  blow. 

6.  You  feel  like  quitting  your  job.  Often. 

7.  You  feel  helpless,  out  of  control. 

8.  You  know  that  whatever  you  do,  things  are  bound  to  go  wrong. 

9.  And  you  know  that  when  they  do,  you’ll  be  the  only  one  who  cares. 

10.  You  feel  guilty  about  taking  a  vacation. 

11.  You  know  the  problem:  it’s  everybody  else. 

12.  You  can’t  stop  thinking  about  your  work.  Ever. 

SOURCE:  SCOTT  STACY.  CLINICAL  PROGRAM  DIRECTOR.  PROFESSIONAL  RENEWAL  CENTER 
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own — a  lonely  and  difficult 
struggle  that  few  executives 
choose  to  face.  Denial  is  easier. 
But  denial  inevitably  extracts 
its  toll  in  health,  relationships 
with  family  and  friends, 
careers,  and  even  lives. 

The  Science  of  Stress 

The  reason  that  stress,  and  our 
response  to  it,  has  so  much 
power  over  us  has  to  do  with 
evolution,  which  as  far  as  stress 
reaction  goes,  stopped  30,000 
years  ago  when  modern  man 
replaced  the  Neanderthal.  Our 
earliest  human  ancestor,  Cro- 
Magnon  man,  needed  to  con¬ 
trol  his  environment  in  specific 
ways  to  avoid  starving  or  being 
eaten  by  predators.  To  survive, 
he  needed  help  holding  off  the 
saber-toothed  tigers  or  bringing 
down  a  mammoth  for  dinner — 
so  evolution  favored  those  who 
felt  uncomfortable  alone  and 
sought  out  the  company  of  oth¬ 
ers.  Knowing  the  guy  in  the 
next  cave  increased  his  survival 
chances,  as  did  his  drive  to  con¬ 
trol  his  environment  by,  say, 
developing  a  mental  map  of  the 
hunting  grounds  nearby,  or 
stacking  a  pile  of  clubs  and 
rocks  near  the  cave’s  entrance 
for  protection.  He  learned  to 
hate  uncertainty  because  in  his 
world,  surprises  were  usually 
lethal. 

Today,  we  hate  uncertainty 
every  bit  as  much  as  our  ances¬ 
tors  did.  Read  the  headlines 
about  Sept.  1 1,  the  postwar  in 
Iraq,  kidnapped  children  or 
even  that  memo  from  the  CEO 
canceling  the  ERP  project,  and 
you’ll  experience  the  same  reac¬ 
tions  that  our  caveman  had 
when  he  noticed  that  the  tigers 
had  moved  from  their  usual 


lair:  sweaty  palms,  an  elevated 
heart  rate.  No  doubt  the  cave¬ 
man’s  worries  and  stress  were 
nearly  constant,  but  he  rarely 
lived  long  enough  to  develop 
stress-related  pathologies  such 
as  heart  disease. 

We  do.  And  science  is  now 
linking  the  daily  anxieties  and 
worries  that  cavemen  felt  to  a 
much  more  powerful,  primitive 
reaction  to  stress,  the  “fight-or- 
flight  response,”  as  researcher 
Walter  Cannon  dubbed  it  in  the 
early  1 900s.  This  is  the  biologi¬ 
cal  process  designed  to  help 
cavemen  out  of  serious  jams 
such  as  a  saber-tooth  suddenly 
showing  up  at  the  door  of  the 
cave.  The  process  is  extremely 
effective  for  its  intended  pur¬ 
pose:  fighting  the  tiger  or  run¬ 
ning  away. 

First,  the  sight  of  the  tiger 
signals  the  brain’s  speed  regula¬ 
tor,  the  locus  coeruleus,  to 
shock  the  rest  of  the  brain  into  a 
state  of  hyperactivity  and  alert¬ 
ness.  The  brain  then  causes  a 
chemical  called  norepinephrine 
to  be  released  into  the  auto¬ 
nomic,  or  involuntary,  nervous 
system — turning  up  the  dial  on 
blood  pressure  and  respiration. 

Simultaneously,  cortisol, 
known  as  the  “stress  hor¬ 
mone,”  shoots  through  the 
bloodstream  to  vital  systems, 
turning  off  those  that  don’t  play 
an  immediate  role  in  survival — 
such  as  digestion  and  the 
immune  system — while  super¬ 
charging  others — such  as  the 
liver — to  provide  extra  sugar  to 
fuel  the  brain  and  muscles. 
Meanwhile,  adrenaline  turns 
up  the  heart  rate  and  blood 
flow.  It’s  like  gunning  the  accel¬ 
erator  at  a  stoplight.  The  body 
is  revving  itself  up  for  what,  in 


The  30,oooYea r-Old  Stress 
Response  and  How  It  Works 

When  you  see  a  tiger  (or  your  CEO)  on  the  prowl... 


BRAIN 

Locus  coeruleus 
shocks  brain  into 
hyperactivity. 
Stress  hormones 
flood  the  system. 


LUNGS - 

Norepinephrine  speeds 
up  respiration. 


HEART 

Adrenaline  turns 
up  heart  rate, 
increases  blood 
pressure. 


LIVER - 

Provides  extra 
sugar  to  fuel  brain 
and  muscles. 


/>- 

*  V 


GUTS 

Cortisol  shuts  down 
digestion  (and  sup¬ 
presses  immune 
response). 


BELLY - 

Fat  cells  open  up  to 
receive  fat— storable 
energy. 


FEET 

Now  you’re  ready 
to  flee  or  fight. 


the  caveman  days,  was  very 
likely  to  follow:  a  life-or-death 
struggle  or  a  frantic  escape. 

The  Wages  of  Stress 

We’ve  come  to  accept  stress  as  a 


normal  part  of  our  lives,  but 
there’s  nothing  normal  about 
lighting  up  our  brains  with 
chemicals  and  shutting  down 
half  the  systems  in  our  bodies 
while  flooding  the  bloodstream 


with  sugar.  Today,  our  bodies 
don’t  get  much  of  a  break  from 
the  stress  response,  which  was 
designed  to  be  an  occasional 
event,  not  a  constant  condition 
of  existence.  “We’ve  all  come  to 
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believe  that  occasional 
headaches  or  muscle  tension 
from  stress  is  normal,  but  it  isn’t 
normal,”  says  Tyne.  “A  normal 
body  doesn’t  have  headaches.” 

Stress  sends  a  constant  flow 
of  sugar  into  the  bloodstream 
to  feed  fleeing  muscles,  but 
with  our  less  active  modern 
lives,  the  sugar  doesn’t  get 
burned  up.  “Having  high  levels 
of  sugar  in  the  blood  is  like  hav¬ 
ing  rust  in  your  gas  tank,  ”  says 
Tyne.  “It  flows  into  every  part 
of  the  engine.”  The  body 
responds  by  releasing  insulin  to 
regulate  the  sugar,  but  over 
time  the  insulin  reaction 
degrades  and  the  excess  sugar 
can  cause  diabetes  and  kidney 
and  circulation  problems. 

The  long-term  effects  of  cor¬ 
tisol  aren’t  much  better.  Our 
metabolism  slows  and  fat  cells, 
particularly  those  around  the 
gut,  open  up  to  receive  more 
fat — the  body’s  most  storable 
source  of  energy.  In  other 
words,  stress  makes  us  fat.  (See 
“Our  Apple-Shaped  Leaders,” 
Page  46.)  Since  cavemen  used 
all  that  extra  sugar  by  fighting 
or  fleeing,  the  brain  evolved  to 
react  to  elevated  cortisol  levels 
by  craving  more  food,  accord¬ 
ing  to  leading  stress  expert 
Pamela  Peeke.  And  not  just  a 
carrot  and  a  rice  cracker.  Stress 
wants  a  burger  with  fries — lots 
of  fats  and  carbohydrates — so 
that  you’ll  have  the  energy 
stored  to  run  next  time.  A  trip 
to  Mickey  D’s  a  survival 
response?  Absolutely.  Your 
body,  after  all,  doesn’t  know 
the  difference  between  a  tiger 
on  the  prowl  and  a  CFO’s 
e-mail.  Fight  or  flight  has 
become  “stew  and  chew,”  as 
Peeke  calls  it. 


Stress  Not 

CIO-specific  suggestions  for  dealing  with  on-the-job  stress,  not  including 
taking  up  yoga.  (Not  that  there’s  anything  wrong  with  that.) 


Accept  the  unfairness.  There  are  a  lot  of  unfair  things  about  being  a  CIO— for  instance,  trying  to  get 
people  to  use  new  systems  without  having  any  authority  over  them.  It  can  all  cause  stress.  Try  to  put  the  job 
in  perspective.  “Every  morning  when  you  get  to  work,  imagine  you’re  pulling  up  a  window  screen  and  it 
says,  Complaint  Department,”  says  Jean  Hollands,  CEO  of  Growth  and  Leadership  Center,  which  coaches 
executives.  “Calculate  how  much  you  make  per  day  and  imagine  that  at  the  end  of  each  day  there's  a  slot  in 
the  door  where  you  pull  your  money  out.  Your  job  is  to  take  complaints  and  know  you’re  being  paid  for  it." 


Level  with  people.  In  a  previous  job,  Carlos  Covarrubias,  now  CIO  of  Dole  Fresh  Flowers,  avoided 
going  into  detail  when  businesspeople  asked  him  technology  questions.  “I  thought  I  was  protecting  users, 
but  it  made  my  discussions  with  them  difficult,”  he  says.  It  also  angered  the  businesspeople,  who 
experienced  that  as  evasiveness.  Now  Covarrubias  addresses  the  deeper  technology  issues.  “It  lowered 
my  stress  level.”  he  says.  “It  allowed  me  to  have  a  different  type  of  conversation  with  executives.” 


Think  about  how  you  com©  across.  “We  have  more  CIOs  sent  to  us  than  any  other  profession; 
they  simply  will  not  understand  that  they  need  to  learn  to  read  others  and  learn  their  impact  on  others,” 
says  Hollands.  Covarrubias  found  this  out  the  hard  way,  in  a  360-degree  review,  when  people  said  he  was 
less  than  communicative.  It  stung  him  badly,  but  at  least  it  provided  him  with  a  clear  path  to  improve. 


Take  five.  Breaks  during  the  day  can  turn  off  the  fight-or-f  light  response,  at  least  temporarily.  Shutting 
the  door  for  five  minutes  and  taking  a  few  deep  breaths  helps,  as  does  visualizing  something  nice,  such  as 
a  vacation.  These  tactics  can  staunch  the  flow  of  stress  chemicals  that  damage  the  body,  says  Sue 
Parkerson  Wisner  of  the  Department  of  Psychiatry  and  Behavioral  Sciences  at  Duke  University  Medical 
Center. 


Control  what  you  can  and  delegate  the  rest.  Feeling  out  of  control  starts  the  stress  hor¬ 
mones  gushing,  so  increase  your  control  where  you  can  (if  one  of  your  direct  reports  is  doing  something 
that  annoys  you,  tell  him  to  knock  it  off),  and  shift  accountability  for  things  you  can’t  control  to  those  who 
can.  For  example,  giving  businesspeople  responsibility  for  technology  projects  is  an  alignment  best 
practice.  It's  also  a  good  way  to  lower  your  stress  level. 


Build  a  support  network  outside  of  work.  Join  a  CIO  peer  group,  a  softball  team  or  a  church. 
Keep  in  touch  with  friends.  Talk  to  them  about  what  you’re  experiencing.  Just  don’t  talk  about  it  in  the 
office.  CIOs  should  avoid  unburdening  themselves  to  subordinates  or  colleagues.  Those  confessions 
could  be  used  against  you.  -C.K. 


Indeed,  researchers  found 
that  Americans  surveyed  after 
Sept.  1 1  said  their  initial  reac¬ 
tion  was  to  avoid  food  (stress 
hormones  initially  suppress 
appetite  so  our  caveman 
wouldn’t  get  distracted  while 
running  from  the  tiger)  fol¬ 


lowed  by  a  tendency  to  overeat 
(the  cortisol  effect). 

Not  that  stress  makes  it  any 
easier  to  digest  the  food  you 
crave.  Since  eating  doesn’t  have 
much  to  do  with  getting  away 
from  the  tiger,  stress  steers 
blood  away  from  the  digestive 


tract,  leading  to  indigestion, 
ulcers  and  more.  Similarly,  sur¬ 
vival  was  more  important  than 
attacking  a  cold  bug,  so 
resources  are  shifted  away  from 
the  immune  system,  increasing 
the  body’s  susceptibility  to 
everything  from  the  trivial — 
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Need  more  network  connections? 
Need  security  and  reliability  in  your  infrastructure? 
Need  an  affordable  way  to  add  LAN  ports? 


Then  you  need  Network  Jack  from  3Com. 
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Add  ports  where  and  when  you  need  them  with 
Network  Jack,  a  revolutionary,  "in  the  wall"  10/100 
switch.  Turn  a  single  port  LAN  wall  outlet  into  four 
Ethernet  ports  in  just  minutes.  With  Network  Jack  you 
avoid  the  hassle  and  expense  of  pulling  cables,  and  it's  more  physically  secure 
than  a  desktop  switch.  Network  Jack  is  available  in  an  unmanaged  version, 
and  a  managed  version  which  supports  port-based  VLANs,  forwards  Power 
over  Ethernet,  and  features  bundled  management  utilities  with  patented 
technology  that  make  troubleshooting  a  breeze.  With  low  cost,  simple 
installation,  and  great  features.  Network  Jack  is  revolutionizing  edge 
switching  technology.  To  learn  more  about  Network  Jack,  visit 
www.3com.com/NetworkJack-CIO 
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"Its  unique  design  enables 
us  to  affordably  install 
additional  ports  in  a 
fraction  of  the  time  and 
cost  previously  required." 


-Tim  Feltner,  Supervisor  of  Telecommunications, 
Cherokee  County  School  District 
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colds,  allergies — to  the  tragic — 
cancer,  multiple  sclerosis  and 
lupus,  to  name  a  few. 

But  the  most  dramatic  impact 
of  stress  is  on  the  circulatory  sys¬ 
tem.  Stress  runs  the  heart  harder 
than  a  16-year-old  drives  a  car. 
The  combination  of  stress  hor¬ 
mones  such  as  cortisol  and 
adrenaline  keep  the  heart  run¬ 
ning  at  a  high  idle.  “Emergency 
room  doctors  use  a  shot  of 
adrenaline  to  get  a  heart  attack 
patient  going  again,”  says  Tyne. 
“Imagine  what  that  does  to 
your  heart  when  it’s  flowing 
constantly.”  But  unlike  a  car, 
your  heart  doesn’t  begin  to  leak 
oil  or  emit  the  telltale  odor  of 
burning  bushings  as  it  runs 
down.  It  just  stops. 

For  50  percent  of  the  people 
who  get  cardiovascular  disease, 
death  is  the  first  symptom, 
according  to  the  American 
Heart  Association. 

Stress  and  the  CIO 

Though  the  evidence  is  still 
being  assembled,  many  scien¬ 
tists  now  believe  that  learning 
how  to  short-circuit  the  fight- 
or-flight  response  may  be  as 
important  to  our  health  as  exer¬ 
cise  and  diet.  For  example,  a 
recent  Duke  University  study  of 
about  1 00  heart  disease 
patients  divided  them  into  three 
groups.  The  control  group  just 
had  regular  medical  checkups, 
another  had  supervised  aerobic 
exercise  classes  three  times  a 
week  for  four  months,  and  the 
third  group  received  stress 
reduction  education  once  a 
week  for  90  minutes  during  the 
same  period.  After  five  years, 
the  first  group  had  experienced 
12  heart  attacks,  the  second 
had  seven,  and  the  third  had 


three.  Results  such  as  those  are 
slowly  convincing  doctors  to 
take  a  hard  look  at  the  mental 
state  of  their  patients. 

The  best  antidote  to  stress  is 
exercise.  And  viewed  in  the  con¬ 
text  of  the  chemistry  of  the 
fight-or- flight  response,  that 
makes  sense.  Exercise  is  simu¬ 
lated  flight — a  chance  for  all  the 
sugars  and  hormones  in  the 
bloodstream  to  be  used  for  their 
intended  purpose.  Exercise  also 
feeds  our  brains  some  feel-good 
drugs  such  as  dopamine  and 
beta-endorphin — evolution’s 
reward  for  safely  escaping 
the  tiger. 

Avoiding  the  stress  response 
itself — feeling  less  stress  in  the 
first  place — is  a  lot  harder.  To 
understand  how  to  control 
stress,  you  have  to  think  your¬ 
self  back  to  the  caves.  Three 
major  psychological  factors 
made  cavemen’s  stress  hor¬ 
mones  flow:  lack  of  control,  fear 
and  isolation.  All  three  have 
modern  correlatives. 

The  CIO  role  is  tailor-made 
for  feeling  out  of  control.  Infra¬ 
structures  can  crash  at  any 
moment,  CEOs  can  change 
their  minds  and  stop  funding 
projects,  businesspeople  can 
resist  using  your  beautiful  new 
system  for  no  good  reason. 

CIOs  have  a  vast  amount  of 
responsibility  but  little  authority 
for  controlling  outcomes.  This 
is  what  psychologists  call  low 
decision  latitude. 

“This  creates  a  sense  of 
chronic  powerlessness,”  says 
Scott  Stacy,  clinical  program 
director  for  the  Professional 
Renewal  Center,  which  counsels 
executives  on  stress.  “You  can’t 
have  an  effect  on  what  you  need 
to  have  an  effect  on  to  generate 
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a  sense  of  [internal]  calm.”  This 
leads  directly  to  health  prob¬ 
lems.  According  to  a  1 997  study 
of  about  3,000  Canadian 
public-service  executives,  those 
with  low  decision  latitude  saw 
their  risk  of  illness  increase  any¬ 
where  from  30  percent  to  1,700 
percent. 

To  see  the  theory  in  action, 
just  ask  a  top  CIO  if  she  would 
like  to  report  to  the  CFO  instead 
of  the  CEO.  “I  wouldn’t  take  a 
job  that  didn’t  report  to  the 
CEO,”  says  Doreen  Wright, 
CIO  of  Campbell  Soup.  “It 
would  be  far  more  stressful. 
Your  scope  of  influence  and 
your  ability  to  execute  is  directly 
tied  to  your  clout  in  the  firm.  If 
you’re  buried  in  finance,  you 
can’t  exert  the  same  influence.” 

Put  in  stress  terms,  reporting 
to  the  CFO  reduces  a  CIO’s  con¬ 
trol  over  his  environment 
because  it  puts  someone 
between  him  and  the  ultimate 
influencer  over  the  company, 
the  CEO. 

CIOs  also  feel  increasingly 
out  of  control  as  the  software 
projects  they  manage  get  bigger 
and  affect  more  people.  That’s 
more  people  the  CIO  can’t 
control.  Users  don’t  have  to  do 
anything  the  CIO  asks.  When 
Gagliardi’s  custom  manufactur¬ 
ing  resource  planning  project 
at  Unisa  had  its  funding 
withdrawn  earlier  this  year,  he 
not  only  lost  control  over  his 
project  but  also  over  the  expec¬ 
tations  of  users. 

“I  had  a  bunch  of  half- 
developed  applications  and  a 
bunch  of  half-trained  develop¬ 
ers,  and  I  tried  to  deliver  what  I 
could,  but  it  wasn’t  working 
out,”  he  says.  Disappointed 
departments  began  criticizing. 
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So  Gagliardi  changed  every¬ 
one’s  expectations,  including  his 
own.  “I  said  we’re  going  to  stop 
the  project  and  go  into  mainte¬ 
nance  mode  on  the  legacy  appli¬ 
cations  until  times  improve,”  he 
says.  “Now  when  my  develop¬ 
ers  manage  to  deliver  something 
new,  it’s  a  pleasant  surprise  for 
everybody,  and  they’re  happy  to 
get  it.” 

Gagliardi  says  that  since  then 
his  stress  level  has  gone  way 
down.  Psychologically,  he 
achieved  the  control  over  his 
environment  that  he  needed  to 
turn  off  his  primal  sense  of 
anxiety — and  his  physiological 
fight-or-flight  response. 

It’s  much  harder  for  CIOs  to 
escape  the  isolation  that  cave¬ 
men  learned  to  dislike  so  much. 
CIOs  who  show  stress  send  it 
rippling  through  their  staffs  like 
a  rock  thrown  into  a  pond. 
Worse,  CIOs  who  confide  in 
their  employees  about  the  stress 
they  feel  risk  having  it  used 
against  them.  “You  need  for 
your  staff  to  know  that  you’re 
human;  you  don’t  need  your 
staff  to  know  that  you’re 
weak,”  says  the  University  of 
Texas’s  Quick. 

Joining  a  CIO  networking 
group  can  help  relieve  the  loneli¬ 
ness,  as  can  a  deep  discussion 
with  your  spouse.  But  neither 
can  change  a  CIO’s  reaction  to 
stress  or  offer  ways  to  relieve  it. 

Indeed,  CIOs  who  feel  iso- 


Talk  to  Connie  Tyne 


Stress  got  you  or  your  staff  m 1 
down?  Until  Aug.  15,  you  can 
ASK  THE  SOURCE 
Connie  Tyne,  executive  director  of  the 
Cooper  Wellness  Program,  about 
managing  stress  before  it  manages  you. 
To  post  your  questions,  go  to 
www.cio.com/ask. 
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Good  News  For 
Type  A  Personalities 

Remember  that  boss  who  said,  "I  don’t  get  ulcers,  I  give 
them?”  The  old  coot  may  have  been  on  to  something. 


Scientists  once  believed  that  high-energy,  aggressive  people- 
so-called  type  A  personalities— were  more  at  risk  for  stress- 
related  disorders  than  others.  But  that  has  proven  not  to  be  the 
case.  In  fact,  some  type  A’s  enjoy  stress  and  see  it  as  a  positive.  In 
effect,  they  simply  don't  experience  what  we  know  as  stress. 

"Competitiveness  does  not  damage  your  health,”  says  psy¬ 
chologist  Sue  Parkerson  Wisner  of  the  Duke  University  Medical 
Center.  Only  type  A's  who  get  angry  or  depressed  have  stress- 
related  health  problems,  she  says. 

Type  A’s  who  don’t  turn  the  steam  inward  have  proven  to  be 
more  like  zebras  than  humans  in  their  response  to  stress,  a 
famous  analogy  first  posed  by  stress  researcher  Robert  Sapolsky 
in  his  1994  book,  Why  Zebras  Don’t  Get  Ulcers.  When  faced  with  a 
threat,  such  as  a  lion  springing  from  the  bush,  zebras  have  the 
same  fight-or-flight  response  as  humans.  But  when  it's  over, 
when  their  brothers  and  sisters  are  now  lunch  and  the  lions  are 
settling  down  for  a  snooze,  zebras  stop  worrying  until  the  next 
time  the  lions  show  up.  So  they  don’t  die  of  stress. 

Psychologically  healthy  type  A’s  behave  the  same  way.  When 
that  big  meeting  is  over,  they  leave  their  stress  in  the  conference 
room.  They  don’t  worry  about  the  next  big  meeting  until  the  lions 
wake  up.  -C.K. 


lated  tend  to  alienate  those 
around  them  who  could  offer 
support.  “No  one  understands 
what  I’m  going  through,  so 
there’s  no  use  in  talking  about 
it,”  is  the  refrain  that  Lee  Smith- 
son,  a  psychologist  and  execu¬ 
tive  coach  for  consultancy  RHR 
International,  hears  a  lot  from 
the  CIOs  she  works  with. 

For  one  of  Smithson’s  clients, 
who  requested  anonymity, 
stress  on  the  job  and  stress  at 
home  marched  in  lockstep.  “He 
was  constantly  having  to  bar¬ 
gain  with  his  wife  for  time,  and 
he  canceled  two  vacations  with 


her  and  their  children,”  Smith- 
son  says.  “His  wife  had  become 
hardened  to  the  whole  situa¬ 
tion.”  When  his  company 
merged  with  another,  he  told  his 
wife  that  he  wanted  to  apply  for 
a  higher  paying  but  more 
demanding  CIO  position  at  the 
new  company.  “She  hit  the 
roof,”  says  Smithson. 

This  man’s  wife  wasn’t  the 
only  unhappy  one.  The  new 
company  told  him  that  unless  he 
revamped  his  approach  to  work 
and  the  way  he  handled  stress, 
he  wouldn’t  get  the  job.  “He 
was  functioning  as  the  consum¬ 


mate  problem-solver,”  says 
Smithson.  But  his  obsession 
with  controlling  his  stress  by 
doing  everything  himself  had 
alienated  him  from  his  staff, 
who  wished  he  would  delegate 
more  often,  and  from  his  superi¬ 
ors,  who  could  never  track  him 
down  for  important  meetings. 
And  when  he  did  attend,  he  was 
so  distracted  that  he  usually  sat 
in  silence. 

It  all  came  out  when  the  new 
company’s  management  asked 
the  putative  CIO  to  take  a  360- 
degree  review.  He  was  stunned 
that  far  from  being  appreciated, 
the  12-hour  workdays  he  was 
putting  in,  and  the  evenings  he 
spent  sifting  through  the  e-mail 
that  had  arrived  while  he  was  off 
putting  out  fires,  was  viewed  as  a 
problem.  “He  had  never  gotten 
that  kind  of  feedback  before,” 
says  Smithson.  “They  said  he 
wasn’t  strategic  and  therefore 
wasn’t  qualified  for  the  job.” 

Like  many  CIOs,  this  man 
was  in  denial.  He  had  become 
withdrawn.  Attempting  to  pro¬ 
ject  strength,  he  was  advertising 
weakness.  Alone  in  his  office 
cave,  he  was  destined  to  become 
some  tiger’s  lunch. 

Fortunately,  spurred  by  the 
review,  he  and  Smithson  were 
able  to  create  a  plan  for  him  to 
distribute  responsibility  among 
his  staff  and  become  more 
involved  in  business  strategy. 
Ultimately,  he  got  the  CIO  job. 

And  last  Spring,  he  took  his 
wife  and  two  kids  to  Disney 
World — along  with  a  cell 
phone.  BE] 


Executive  Editor  Christopher  Koch 
usually  flees  on  his  bike.  You  can 
share  your  ideas  on  handling  stress 
with  him  at  ckoch@cio.com. 


48  CIO  AUGUST  1,  2003  •  www.cio.com 


You  ve  Picked 

a  Winner! 

CIO  magazine  is  the  proud  recipient  of  the 


prestigious  2003  Grand  Neal  Award— the 
top  editorial  honor  granted  to  one  publica 
tion  from  more  than  1,000  entries  across; 
all  categories  and  circulation  sizes.  CIO 
also  won  Neal  Awards  for  “Best  How  To” 
for  the  2002/2003  Year-End  Issue  and 
“Best  Article”  for  “Microsoft’s  New  Sub 
scription  Plan:  CIOs  Just  Say  No.” 
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The  Neal  Award  judges  aren’t  the  only  ones 
who  prefer  CIO  magazine.  CIOs  choose  CIO 
as  the  one  publication  they  rely  on  for  in 


sight  and  strategies  for  managing  IT.' 


Often  hailed  for  its  preeminence 
as  the  “Pulitzer  Prize  of  the  business 
press,"  the  Neal  Award  is  the 
business  publishing  industry’s 
annual  salute  to  individual  editors 
for  outstanding  editorial  excellence. 
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We  can. That’s  why  IBM  has  devoted  a  tremendous  amount  of  resources  to  Linux? 
We  have  over  7000  IBMers  working  on  Linux-related  projects. Thousands  of  Linux 
customer  engagements.  And  more  Linux-enabled  software  than  anyone.  To  learn 
more  about  IBM,  Linux  and  visit  ibm.com/linux/seeit 
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A  Special  Two-Part  Report  on  IT  &  Health  Care 


Part  1:  Paperless  Medicine 


Health-care  CIOs  face 
intense  pressure  to 
install  electronic  medical 
records  and  order-entry 
systems,  in  spite  of 
physician  resistance 
and  large  up-front  costs. 
Here’s  how  early 
adopters  are  overcoming 
the  obstacles. 


On  a  gritty  Brooklyn  block  cluttered  with  automobile  body  shops,  a 

janitorial  supplies  outlet  and  a  truck  depot  for  Gino’s  Italian  Ice  sits  a  one- 
story  building  with  corrugated  metal  siding  the  color  of  pistachio  ice  cream. 
It’s  an  unlikely  setting  for  a  hospital  IT  department  and  an  even  unlikelier  set¬ 
ting  for  a  revolution  in  American  health  care.  Yet  inside,  that’s  precisely 
what’s  going  on. 

Ten  blocks  from  the  705-bed  Maimonides  Medical  Center,  Senior  Vice 
President  and  CIO  Ann  C.  Sullivan  has  finished  a  $44  million  technology 
transformation  that  in  seven  years  has  taken  the  hospital  from  punched 
cards  to  a  sophisticated  system  of  electronic  medical  records  (EMR)  and 
computerized  physician  order-entry  (CPOE). 

Today,  every  one  of  Maimonides’  doctors— not  only  its  277  employed 
physicians  but  also  978  community  physicians  with  hospital  privileges— 
log  on  to  order  medications  and  tests, 
check  lab  results,  and  track  treatment.  One 
in  every  five  prescriptions  is  flagged  by 
the  system  for  a  possible  problem— an 
allergy  or  an  adverse  drug  interaction.  The 
average  turnaround  time  for  administering 
medicine  to  inpatients  now  has  been  cut 
from  five  hours  to  90  minutes.  Physicians 
receive  all  reports  online  from  the  radiology 


Reader  ROI 

►  Why  the  payoff  from 
electronic  medical 
records  is  so  great 

►  What’s  behind  the  pain 
of  implementing  them 

►  How  to  win  over  reluc¬ 
tant  physicians 
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Ann  Sullivan,  CIO  of  Maimonides 
Medical  Center  in  Brooklyn,  N.Y., 
has  installed  an  electronic 
records  and  order-entry  system 
that  boosted  hospital  revenue 
by  $12.5  million  last  year. 
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department  within  24  hours  (formerly,  it 
was  five  days),  and  they  no  longer  have  to 
reorder  tests  for  the  estimated  15  percent  of 
film  records  that  used  to  get  lost.  Last  year, 
revenue  increased  $50  million,  and  hospital 
officials  attribute  a  fourth  of  that  jump  in 
revenue  to  the  new  IT  systems.  In  addition, 
the  annual  cost  of  the  hospital’s  malpractice 
insurance  just  dropped  $  1  million,  a  savings 
largely  credited  to  the  new  systems. 

Advanced  systems  like  these  could  reduce 
U.S.  hospitalization  costs  by  $2  billion  a 
year.  And  if  similar  systems  were  used  in 
doctors’  offices  and  clinics  as  well  as  hospi¬ 
tals,  they  could  prevent  thousands  of  deaths 
from  medical  errors  and  save  the  U.S. 
health-care  system  a  whopping  $44  billion 
each  year — taking  a  significant  bite  out  of 
the  $1.4  trillion  America  annually  spends 
on  health  care.  Health-care  costs,  which  in 
2001  constituted  14  percent  of  the  gross 
domestic  product,  continue  to  soar,  slicing 
into  business  profits  and  exacerbating  state 
and  federal  deficits.  An  increasing  number  of 
employers  are  cutting  back  on  health  cov¬ 
erage  or  offering  none  at  all.  The  enormous 
efficiencies  of  electronic  medicine  could  ame¬ 
liorate  this  deepening  crisis. 

The  good  news  is  that  this  push  toward 
paperless  medicine  seems  inevitable.  Insur¬ 
ance  companies  have  begun  rewarding  physi¬ 
cians  and  hospitals  for  using  IT  to  reduce 
errors.  And  a  2002  survey  found  that  46  per¬ 
cent  of  physician  executives  work  for  organ¬ 
izations  that  have  invested  in  EMRs  or  plan 
to  do  so  in  the  next  year — more  than  double 
the  number  reported  in  2001. 

The  bad  news  is  that  there’s  still  enor¬ 
mous  resistance  to  these  systems.  At  pres¬ 
ent,  Maimonides  Medical  Center  is  among 
only  10  percent  of  U.S.  hospitals  that  have 
implemented  inpatient  order-entry  systems 
that  check  for  errors.  Most  health-care  enti¬ 
ties  are  moving  much  more  slowly,  both 
because  of  the  tremendous  up-front  costs 
(Maimonides  has  been  spending  one-third 
of  its  capital  expenditures  on  IT)  and  resist¬ 
ance  from  physicians  who  see  no  reason  for 
changing  the  way  they  practice. 

CIOs  are  at  the  center  of  this  tug-of-war. 


They’re  the  ones  who  must  drive  this  trans¬ 
formation,  delivering  systems  without  incur¬ 
ring  dangerous  downtime  or  allowing 
medical  files  to  fall  into  the  wrong  hands. 

“The  pressures  in  health  care  are  such 
that  in  the  next  two  or  three  years  we’re 
going  to  have  to  achieve  a  new  level  of  effi¬ 
ciency,”  says  David  Pecoraro,  vice  president 
and  CIO  of  the  Jewish  Hospital  HealthCare 
Services,  which  has  installed  systems  similar 
to  those  at  Maimonides. 

“CIOs  are  feeling  the  heat.” 

THE  PROBLEM  WITH  PAPER 

o  what’s  wrong  with  a  medical  sys¬ 
tem  based  on  paper?  To  begin  with, 
paper  gets  lost.  Paper  degrades.  And 
no  matter  how  voluminous,  paper  files  are 
limited  in  the  quality  and  quantity  of  data 
they  contain. 

The  goal  of  an  EMR  system  is  to  collect 
the  data  on  those  pieces  of  paper  and  make 
it  dynamic.  Say,  for  instance,  a  patient  has 
diabetes.  EMRs  can  help  a  doctor  track  how 
the  disease  has  progressed  over  the  years, 
without  hunting  through  pages  of  scribbled 
medical  notes. 

And  if  the  system  is  properly  coded — if, 
for  instance,  it  knows  that  a  heart  attack  is 
the  same  as  a  myocardial  infarction — it  can 


Mark  Andersen,  CIO  of  Yale  New  Haven 
Health  System,  says  it’s  important  to 
make  patients  and  doctors  aware  of  the 
security  precautions  put  in  place  to  limit 
access  to  electronic  medical  records. 

do  much  more  than  track  a  patient’s 
progress.  It  can,  for  example,  track  patients 
in  the  aggregate  to  determine  how  well  doc¬ 
tors  are  managing  specific  diseases.  For 
instance,  at  Intermountain  Health  Care,  a 
Salt  Lake  City-based  insurance  and  health¬ 
care  provider,  officials  can  now  see  how 
many  diabetics  have  acceptable  levels  of 
hemoglobin  Ale — a  key  indicator  of  how 
well  they  (and  by  extension,  their  doctors) 
are  coping.  Now  Intermountain  issues  a 
report  card  on  individual  physicians  and  can 
determine  whether  the  organization  is  get¬ 
ting  better  at  treating  diabetes. 

That’s  all  good,  but  it  gets  better.  Once 
an  EMR  system  is  in  place,  the  next  step  is 
a  CPOE  system.  It  allows  a  provider  to 
request  medications,  lab  tests  and  radiology 
procedures  like  CAT  scans  or  MRIs.  Ideally, 
the  doctor  gets  an  automatic  notification 
about  test  results.  But  CPOEs,  like  EMRs, 
run  the  gamut  from  simple  systems  that  do 
little  more  than  computerize  a  prescription 
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pad  to  complex  ones  that  check  for  every¬ 
thing  from  decimal  point  errors  to  drug 
interactions  and  allergies  to  whether  recent 
tests  show  that  a  particular  medication 
might  be  contraindicated. 

Research  has  shown  that  CPOEs,  tightly 
linked  to  EMRs,  can  prevent  more  than  half 
of  all  serious  inpatient  medication  errors — 
a  political  hot  button  ever  since  the  Insti¬ 
tute  of  Medicine  issued  a  1999  landmark 
report  revealing  that  as  many  as  98,000 
people  a  year  die  in  hospitals  from  medical 
errors.  The  Leapfrog  Group,  a  collection  of 
insurers  that  has  banded  together 
to  improve  patient  safety,  has 
made  CPOE  one  of  its  top  three 
priorities.  In  California,  lawmak¬ 
ers  set  a  2005  deadline  requiring 
hospitals  to  submit  reports  on  how 
they  will  use  IT  to  reduce  medical 
errors.  New  York’s  Empire  Blue 
Cross  Blue  Shield,  in  an  incentive 
program  that  involves  four  of  its 
key  accounts,  IBM,  PepsiCo,  Veri¬ 
zon  Communications  and  Xerox, 
already  has  paid  out  $195,000  in 
bonuses  to  New  York  City  hospi¬ 
tals  that  met  Leapfrog’s  standards 
for  quality  improvement. 


PHYSICIAN  RESISTANCE 

r\  l~\  f~J  hile  there  is  increasing 
\  "  A  /  Pressure  to  convert  to 
VJ  VJ  electronic  patient  systems, 
getting  there  won’t  be  easy.  “This  is 
worse  than  taking  a  horse  to  water 
and  making  him  drink,”  says  Greg 
Walton,  CIO  of  Carilion  Health  Sys¬ 
tem  in  Roanoke,  Va.  “This  is  more 
like  teaching  horses  to  dig  wells.” 

That’s  because  EMRs  in  general, 
and  CPOE  systems  in  particular, 
require  that  physicians  change  the 
way  they  practice  medicine.  It 
starts  with  the  most  fundamental 
question  of  how  can  doctors  look 
at  a  patient  and  a  computer  screen 
at  the  same  time,  and  only  gets 
more  complicated. 

Fortunately,  the  CIO  who  wins 


over  the  horse  gets  the  whole  barn.  Physi¬ 
cians — not  boards  of  directors,  not  insurance 
companies,  not  even  patients — are  the  ones 
who  really  need  to  be  convinced  that  new¬ 
fangled  IT  systems  are  worth  their  time  and 
money.  If  a  doctor,  especially  a  good  one, 
doesn’t  like  the  way  one  hospital  is  doing 
something,  she  can  take  her  business — and 
her  patients — elsewhere. 

The  value  proposition  is  especially  diffi¬ 
cult  for  physicians  in  private  practice  who 
have  to  pay  for  the  systems  out  of  their  own 
earnings  (see  “The  Private  Practice  Value 


Saving  Lives 


Proposition,”  Page  56).  But  even  in  hospi¬ 
tals,  where  there  are  economies  of  scale, 
CIOs  have  found  CPOE  systems  a  hard  sell. 

Speedier  lab  results  is  one  key  selling 
point.  Quick,  wireless  access  to  clinical  data 
is  another  (see  “Wireless:  Just  What  the 
Doctor  Ordered,”  Page  60).  Remote  access, 
so  that  doctors  can  log  on  from  home  or  the 
office  to  check  on  the  status  of  a  patient  in 
the  hospital,  is  yet  another. 

Ultimately,  the  best  selling  point  is  the 
simple  fact  that  these  systems  improve 
patient  care.  “It’s  the  right  thing  to  do,”  says 
Mark  Andersen,  CIO  of  Yale  New 
Haven  Health  System. 


Advanced  outpatient  systems  that  recommend  drugs, 
alert  physicians  to  order  tests,  and  check  for  errors  in 
drug  dosage  prevent  far  more  errors  and  hospitaliza¬ 
tions  than  basic  systems  that  merely  record  orders. 
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Saving  Money 


The  larger  the  medical  practice  or  clinic,  the  greater  the 
net  savings  from  electronic  drug  order-entry  systems. 
Here  is  the  net  return  per  provider  after  five  years. 


While  the  net  return  for  a 
single-physician  practice  is 
negative,  the  ROI  for  a  200- 
physician  outpatient  clinic  is 
$111K  over  five  years. 
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Number  of  Physicians  in  Practice 


200 


SOURCE:  CENTER  FOR  INFORMATION  TECHNOLOGY  LEADERSHIP  ( WWW.CITL.ORG ) 


DOCTORS  ON  BOARD 

I  \  s  has  historically  been  the 
/  A  \  case  with  IT,  success  usu- 
LJ  V_A  ally  starts  with  a  few 
early  adopters.  That’s  what  Dr. 
Robert  Kolodner,  acting  deputy 
CIO  for  health  at  the  Department 
of  Veterans  Affairs  and  acting  chief 
health  informatics  officer  for  the 
Veterans  Health  Administration, 
has  found.  “You  go  with  the  people 
who  are  excited  and  willing  to  try 
things  out  early  on,”  says  Kolod¬ 
ner,  whose  federally  funded  organ¬ 
ization  has  given  all  163  of  its 
facilities  access  to  EMRs  and 
CPOEs.  “You  kind  of  work  out  the 
kinks — there  are  always  kinks — 
with  the  group  that  will  be  much 
more  tolerant  when  things  don’t  go 
completely  right.” 

These  systems  don’t  succeed 
unless  clinicians  are  involved  from 
the  get-go.  Many  IT  shops  with 
successful  EMR  implementations 
have  doctors,  nurses  and  pharma¬ 
cists  on  staff  who  spend  part  of 
their  time  in  IT  and  part  of  their 
time  with  patients  and  medical 
peers.  This  helps  give  the  CIO 
credibility,  but  it  also  makes  the 
systems  work.  With  earlier  ver¬ 
sions  of  CPOEs  and  EMRs,  IT 
departments  had  to  build  in  error- 
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checking  functions  and  definitions  by  them¬ 
selves.  Now,  vendors  are  building  more 
rules  and  definitions  into  the  products,  but 
individual  hospitals  still  need  to  modify  the 
systems  to  fit  their  policies. 

For  example,  at  Kaiser  Permanente 
Northwest,  the  EMR  system  used  to  issue 
alerts  for  all  female  patients  who  were  due 
for  mammograms.  Physicians  showed  that 
some  patients  didn’t  want  the  tests  (for  cul¬ 
tural  reasons)  or  didn’t  need  them  (because 
they’d  had  mastectomies).  “We  needed  to 
find  a  mechanism  to  turn  off  the  alert  for 
certain  patients,”  says  Dr.  Homer  Chin, 
Kaiser’s  assistant  regional  medical  director 
for  clinical  information  systems.  “There  are 
thousands  of  little  things  like  that.”  Work¬ 
ing  closely  with  the  vendor,  Chin’s  group 
has  fixed  a  number  of  these  kinks,  and  now 
Kaiser  is  planning  to  roll  out  the  Northwest 
system  to  the  organization  nationwide,  to 


the  tune  of  $1.8  billion  over  10  years. 

Bottom  line:  It  pays  to  listen  to  your  doc¬ 
tors.  But  dealing  with  them  takes  patience. 
The  more  physicians  use  the  system,  the 
more  tweaking  needs  to  be  done.  Inter¬ 
mountain  Health  Care,  for  instance,  has 
managed  to  get  physicians  to  enter  patient 
notes  directly  into  the  computer  systems.  To 
get  there,  the  IT  department  worked  closely 
with  physicians  to  develop  what  CIO  Carvel 
Whiting  calls  “hot  text” — templates  that 
physicians  can  pull  up  for  certain  types  of 
visits  and  fill  out  with  just  a  few  keystrokes. 

Whiting  now  has  some  happy  customers. 
“I  was  in  a  meeting  a  while  ago  with  a  num¬ 
ber  of  docs  in  our  clinics,  and  they  said,  ‘If  I 
had  to  do  this  the  old  way  it  would  take  me 
an  extra  hour-and-a-half  a  day,”’  he  says. 

But  new  systems  mean  new  expecta¬ 
tions;  now  physicians  won’t  put  up  with 
any  downtime. 


NEW  HEADACHES 

o  one  remembers  what  life  at  Yale- 
New  Haven  Hospital  was  like 
before  the  CPOE  system.  So  when 
it  is  taken  down — which  happens  every 
month  for  scheduled  maintenance — “you 
can’t  say,  Do  what  you  did  before,”  says 
Howard  Goldberg,  the  hospital’s  director  of 
clinical  systems,  who  reports  to  CIO  Ander¬ 
sen.  “When  you’ve  been  up  for  1 1  years, 
there  is  no  before.  Doctors  don’t  know  how 
to  write  an  order  by  hand.”  That’s  where  a 
portable  gray  file  box  stashed  in  every  unit 
comes  in  handy.  Inside  the  file  box  are 
instructions  and  prescription  and  other 
order  forms. 

Yes,  paper. 

But  the  chief  of  staff  is  putting  pressure 
on  Andersen  to  get  rid  of  the  paper.  So,  as 
part  of  an  upgrade  while  converting  to  a  new 
version  of  CPOE  software,  Andersen  is  split- 
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To  entice  doctors  to  pay  for  advanced  systems,  the  health-care  industry  has  to  find 
the  sweet  spot  where  good  medicine  and  good  business  intersect 


If  you  think  getting  hospital  physicians  to  use  a  computer¬ 
ized  physician  order-entry  (CPOE)  system  is  a  tough  sell, 
you’re  right.  But  convincing  physicians  to  pay  for  a  CPOE 
in  their  own  practices  is  even  harder.  Yet  that’s  precisely 
where  the  greatest  benefits  will  be  found. 

The  Center  for  Information  Technology  Leadership  (CITL),  a 
research  organization  founded  by  Partners  Healthcare  System 
in  Boston,  estimates  that  advanced  CPOE  in  outpatient  settings 
could  save  the  U.S.  health-care  system  $44  billion  a  year.  The 
systems  save  money  not  only  by  preventing  errors  but  also  by 
suggesting  less  expensive  drugs  and  avoiding  unnecessary  or 
duplicate  lab  tests.  The  problem  is,  these  savings  don’t  neces¬ 
sarily  go  to  doctors,  despite  the  fact  that  they’re  the  ones  being 
asked  to  foot  the  bill  for  the  systems. 

With  a  big  enough  practice,  economies  of  scale  do  kick  in. 

CITL  estimates  that  for  a  practice  with  50  providers,  the  net  sav¬ 
ings  on  installing  these  systems  would  be  $104,000  per  provider 
over  five  years.  But  75  percent  of  U.S.  physicians  practice  in  a 
group  with  five  or  fewer  doctors,  where  the  numbers  are  not  so 
enticing.  Dr.  Blackford  Middleton,  CITL’s  chairman,  says  that  an 
advanced  CPOE  costs  each  physician  in  a  five-person  practice 


$122,000  for  the  first  five  years— or  about  $25,000  per  doctor 
per  year. 

Partners  is  trying  to  improve  the  value  proposition  by  chang¬ 
ing  its  managed  care  contracts  to  a  pay-for-performance  model. 
In  this  kind  of  system,  physicians’  pay  is  based  on  not  just  what 
they  do  but  on  how  well  they  do  it.  A  physician  might  get  extra 
credit  for  prescribing  a  generic  drug  rather  than  a  brand  name 
one,  or  for  having  a  diabetic  pass  certain  checks— all  things  that 
can  be  done  and  then  proven  much  more  easily  digitally  than 
with  paper-based  systems. 

Employers  are  also  beginning  to  offer  similar  incentives. 
Bridges  to  Excellence,  which  involves  corporate  heavyweights 
like  Ford,  GE  and  Procter  &  Gamble,  is  offering  qualifying  physi¬ 
cians  a  $55  bonus  per  patient  for  improved  care. 

John  Glaser,  vice  president  and  CIO  of  Partners  Healthcare 
and  a  member  of  CITL’s  executive  committee,  hopes  programs 
like  these  will  help  make  the  inconvenience  and  up-front  costs  of 
CPOE  worth  the  physician’s  while.  "People  paint  doctors  as 
technophobes,”  he  says.  “That’s  just  not  true.  But  they  do  want 
to  know  the  value.  You  have  to  have  a  pretty  good  case  for  why 
you’re  going  to  bother  with  this.”  -S.S. 
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ting  the  data  between  two  separate  data  cen¬ 
ters  three-quarters  of  a  mile  apart.  Andersen 
knows  what  some  other  health-care  CIOs, 
like  John  Halamka  of  CareGroup  in  Boston, 
have  learned  the  hard  way:  The  more  mis¬ 
sion-critical  hospital  IT  systems  become,  the 
greater  the  risks  of  downtime  (read  “All  Sys¬ 
tems  Down”  at  wunv.cio.com/prmtlinks). 

Making  sure  the  network  is  crash-proof 
is  only  part  of  the  CIO’s  problem.  Not  only 
are  health-care  organizations  making  patient 
files  electronic,  they’re  putting  them  online 
for  remote  access  by  doctors  and  even,  in  a 
few  pilot  programs,  by  patients. 

This  raises  new  privacy  and  security  con¬ 
cerns.  What  happens  if  someone  breaks  into 
a  database  of  health  information  and  uses 
it  to  embarrass  patients,  commit  identity 
theft  or  even  make  a  profit  on  the  black 
market — say,  by  selling  medical  records  to 
unscrupulous  mortgage  companies  looking 
for  reasons  not  to  grant  loans? 

These  are  valid  enough  concerns  that  the 
federal  government,  with  the  passage  of  the 
Health  Insurance  Portability  and  Account¬ 
ability  Act  (HIPAA),  has  set  strict  rules 


around  how  patient  data  must  be  secured 
and  in  what  cases  it  may  be  shared  outside 
the  organization.  (For  more,  read  “Immune 
Systems”  at  www.cio.com/printlinks.) 

Health-care  entities  have  to  do  a  better 
job  of  explaining  their  safety  precautions. 
At  Yale-New  Haven,  for  instance,  a  few 
patients  bristled  when  the  time  came  to 
upgrade  the  AIDS  clinic  with  an  EMR  sys¬ 
tem  because  they  were  worried  their  per¬ 
sonal  information  would  fall  into  the  wrong 
hands.  Yale-New  Haven  officials  took  pains 
to  explain  that  only  certain  people  would 
have  access  to  those  files.  What’s  more,  hos¬ 
pital  officials  can  see  who  is  looking  at 
which  files  and  when.  “Once  our  analyst 
was  able  to  show  the  patients  that  we  could 
now  document  everybody  who  looked  at 
their  record,  they  actually  felt  more  com¬ 
fortable,”  Andersen  says. 

GETTING  TO  THE  INEVITABLE 

espite  the  benefits  of  EMRs,  there  will 
always  be  some  clinicians  who  don’t 
want  to  change.  That’s  where  CIOs 
must  rely  on  executive  backup:  a  mandate, 


straight  from  the  top,  that  everyone — no  excep¬ 
tions — will  use  the  EMR  and  CPOE  systems. 

Hospital  administrators  “need  to  com¬ 
municate  the  target  and  hold  a  gentle,  steady 
pressure  to  achieve  it,”  VA’s  Kolodner  says. 
“After  about  six  months,  if  you’ve  put  in  a 
system  that  meets  the  providers’  needs,  it 
becomes  self-sustaining.  The  peers  start  say¬ 
ing,  Would  you  please  put  your  notes  in 
there?  I  don’t  want  to  have  to  get  the  records 
because  it  slows  me  down.” 

This  mandate  is  hard  enough  to  enforce 
at  places  like  the  VA  facilities,  where  physi¬ 
cians  are  on  staff  and  rely  on  paychecks.  But 
it’s  most  difficult  at  community  hospitals 
that  don’t  have  power  over  doctors  who 
aren’t  employees. 

Just  ask  Maimonides’  Sullivan.  “We  went 
live  with  an  electronic  record  order-entry  sys¬ 
tem  on  Dec.  15,  1996,”  she  says.  “I  remem¬ 
ber  the  day  well.  One  doctor  walked  up  to 
me  in  the  hospital.  He  said  that  because  of 
the  system,  he  was  going  to  retire.” 

Fortunately,  he  was  the  only  doctor  who 
left.  Today,  Sullivan’s  systems  are  cranking 
away — saving  money,  saving  lives.  In  the 
emergency  department,  the  floor  and  hallways 
are  crowded  with  patients  on  stretchers.  Police 
keep  close  guard  over  one  patient,  while 
another,  blood  caked  below  one  eye,  yells 
“doctor”  every  few  seconds.  The  scene  seems 
chaotic,  but  appearances  can  be  deceiving. 

Dr.  Steven  Davidson,  chairman  of  the 
emergency  medicine  department,  logs  on  to 
a  computer.  At  a  glance,  he  can  see  the  loca¬ 
tions  of  all  the  ER  patients,  the  severity  of 
their  conditions,  the  status  of  their  treat¬ 
ments.  He  knows  that  an  elderly  woman  in 
the  hallway  needs  to  be  assigned  a  room, 
that  another  patient’s  chest  X-ray  is  back 
from  the  lab.  Dressed  in  a  bow  tie  and  lab 
coat,  Davidson  is  imposing  order  on  the 
chaos.  “[I  knew]  there  had  to  be  something 
medicine  could  use  from  the  business 
model,”  he  says  over  the  racket. 

He  was  right.  HH 


Sarah  D.  Scalet  is  a  senior  writer  for  CIO.  Send  feed¬ 
back  to  Executive  Editor  Alison  Bass  via  e-mail  at 
ahass@dn.mm. _ _ 


How  to  Become  Paperless 

Eight  tips  for  success  from  CIOs  who  have  been  there,  done  that 


1.  THINK  LIKE  A  DOCTOR.  Treat  an  electronic  medical  records  (EMR)  system  like  a 
clinical  project,  not  an  IT  one.  Many  hospital  IT  departments  pay  a  share  of  the 
salaries  of  physicians,  nurses  and  pharmacists  who  spend  part  of  their  time  in  IT 
and  part  of  their  time  with  patients. 

2.  DON’T  SKIMP  ON  TRAINING.  For  the  most  effective  results,  consider  one-on-one 
training  for  physicians  rather  than  classroom  instruction. 

3.  PREPARE  FOR  A  PRODUCTIVITY  HIT  ANYWAY.  EMRs  have  a  huge  impact  on  how 
clinicians  do  their  daily  work. 

4.  THINK  OF  RESISTANCE  AS  FEEDBACK.  Most  of  the  physicians  who  push  back  will 
have  valid  points  and  concerns. 

5.  START  WITH  THE  VALUE.  Once  physicians  get  something  out  of  the  EMR— like 
faster  lab-test  results— they’ll  be  more  likely  to  accept  further  changes. 

6.  EXPECT  PROBLEMS.  Have  backup  processes  in  case  the  system  goes  down. 

7.  BE  READY  TO  MAKE  CHANGES.  The  real  work  begins  after  the  implementation, 
when  clinicians  will  want  to  fix  problems  and  add  functionality. 

8.  GET  AN  EXECUTIVE  MANDATE.  The  CEO  must  require  everyone  to  use  the  new 

systems,  but  this  should  only  be  your  final  nudge  toward  adoption.  -S.S. 
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Here’s  what  some  very  smart  people  are  saying.  Gartner  has  just  positioned  Pegasystems  in  the  Leaders  quadrants 
in  both  its  Business  Rule  Engine  and  Pu re-Play  BPM  Magic  Quadrants  —  the  only  company  to  be  so  recognized.  Smart  and  simple- 
to-use  business  process  management  can  be  achieved  only  when  driven  by  sophisticated  rules  engines.  Our  unique  approach 
gives  you  the  agility  to  more  easily  manage  both  the  processes  and  the  business  decisions  that  drive  them  — 
not  just  the  routing  and  assigning  of  work,  but  also  its  resolution.  So  you  achieve  real  ROI.  It's  simply 
smart  BPM™  and  it's  only  from  Pegasystems.  For  copies  of  the  full  Gartner  Magic  Quadrant 
reports,  call  1-866-PEGA-BPM,  or  visit  www.pega.com/mq. 


simply  smart  BPM' 


NOTE:  Research  Note  The  Business  Rule  Engine  2003  Magic  Quadrant,  J.  Sinur,  7  April  2003;  and  Research  Note  Magic  Quadrant  for  Pure-Play  BPM,  2Q03,  J.  Sinur,  J.  Thompson,  2  June  2003.  The  Magic  Quadrant  is  copyrighted  by  Gartner,  Inc  and  is  reused 
with  permission,  which  permission  should  not  be  deemed  to  be  an  endorsement  of  any  company  or  product  depicted  in  the  quadrant.  The  Magic  Quadrant  is  Gartner,  Inc.'s  opinion  and  is  an  analytical  representation  of  a  marketplace  at  and  for  a  specific 
time  period  It  measures  vendors  against  Gartner  defined  criteria  for  a  marketplace.  The  positioning  of  vendors  within  a  Magic  Quadrant  is  based  on  the  complex  interplay  of  many  factors.  Gartner  does  not  advise  enterprises  to  select  only  those  firms  in  the 
“Leaders"  quadrant.  In  some  situations,  firms  in  the  Visionary,  Challenger,  or  Niche  Player  quadrants  may  be  the  right  matches  for  an  enterprise  s  requirements.  Well-informed  vendor  selection  decisions  should  rely  on  more  than  a  Magic  Quadrant.  Gartner 
research  is  intended  to  be  one  of  many  information  sources  including  other  published  information  and  direct  analyst  interaction.  Gartner,  Inc.  expressly  disclaims  all  warranties,  express  or  implied,  of  fitness  of  this  research  for  a  particular  purpose. 


‘If  you're  not  entering 
data  as  you  go,  a  lot  of 
efficiency  is  lost,"  says 
OSU  Medical  Center’s 
Dr.  Andrew  Thomas 
(above,  right),  who's 
getting  that  efficiency 
through  Enterprise 
Systems  Director  Phil 
Skinner’s  (above,  left) 
wireless  systems. 
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Electronic  medical  records  systems  top  hospital  CIOs’  agendas  because 

they  can  prevent  errors,  enforce  standards,  make  staff  more  efficient,  simplify  record 
keeping  and  improve  patient  care. 

But  the  systems  deliver  only  when  doctors,  nurses  and  other  medical  staff  actually  use 
them. 

In  hospitals,  where  patients  and  medical  staff  are  constantly  moving,  it’s  difficult  for 
staff  members  to  take  a  break  to  enter  patient  data,  or  to  order  tests  and  medications. 
So,  even  though  many  hospitals  began  installing  data-access  terminals  a  decade  ago 
at  nurses’  stations  and  near  hospital  wards,  staff  members  still  tend  to  scribble  notes 
a  few  hours  before  they  enter  data  and  place  orders.  That  can  lead  to  transcription 
errors,  delays  in  test  results  and  incomplete  records  when  other  staff  look  up  a 
patient’s  status. 

Health-care  information  has  to  be  available  anytime,  anywhere.  “We  didn’t  see  any 
other  way  to  do  it  other  than  wireless,”  says  Tim  Stet- 
theimer,  vice  president  and  CIO  of  St.  Vincent’s  Hospi¬ 
tal  in  Birmingham,  Ala. 

“If  you’re  not  entering  data  as  you  go,  a  lot  of  effi¬ 
ciency  is  lost.  With  paper,  it  sits  in  a  pocket  for  an  hour, 
then  sits  in  a  bin,"  says  Dr.  Andrew  Thomas,  assistant 
dean  and  internal  medicine  professor  at  Ohio  State 
University  (OSU)  Medical  Center,  a  teaching  hospital 
in  Columbus,  Ohio. 

That’s  why  wireless  systems,  especially  those  based 
on  the  802.11b  standard  (also  known  as  Wi-Fi),  are 
more  widely  deployed.  This  new  conduit  lets  staff 
access  and  update  records  and  make  orders  at  the 


Reader  ROI 

►  Why  wireless  is 

a  key  technology  for 
electronic  medical 
records  systems 

►  What  other  industries 
can  learn  from  hospital 
wireless  projects 

►  How  CIOs  can  use 
wireless  networks  to 
support  voice  and 
other  applications 


BY  GALEN  GRUMAN 

As  medical  records  go 
electronic,  hospital 
CIOs  are  finding  that 
wireless  networks 
can  get  the  records  to 
where  the  doctors 
and  nurses  want  to 
use  them.  CIOs 
in  other  industries 
would  do  well  to 
watch  and  learn. 
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point  of  care.  That  reduces  errors  and 
delays,  and  fits  into  the  doctors’  and  nurses’ 
workflow.  And  they’re  inexpensive  to 
deploy,  costing  a  few  percent  of  the  total 
budget  of  an  electronic  medical  records 
(EMR)  system.  Plus,  they  can  be  a  spring¬ 
board  to  services  such  as  communications 
badges  and  mobile  sensors.  (See  “Where 
Health  Care  Leads  the  Way,”  this  page.) 

MORE  PATIENT  FACE  TIME 

r.  Bruce  Brown,  a  physician  at  St. 
Vincent’s,  says  he  believes  using 
mobile  technology  to  access  and 
update  medical  records  will  help  him 
spend  more  time  with  patients. 

Before  Brown  began  using  a  wireless 
wearable  computer  from  Xybernaut,  com¬ 
plete  with  an  LCD  screen  mounted  on  his 


glasses,  he  commuted  between  his  patients 
and  hills  of  paper.  “I  used  to  work  on  a  stack 
of  papers,  then  see  the  patient,  then  go  back 
to  the  patient’s  stack  of  papers,”  he  says.  “I 
spent  only  20  percent  of  my  time  on  a 
patient  in  front  of  me.”  With  wireless  sys¬ 
tems,  where  he  can  access  records  and  order 
needed  tests  while  still  with  the  patient,  “I 
expect  that  to  increase  to  50  to  60  percent.” 
Brown  has  also  seen  the  cycle  time  per 
patient — from  diagnosis  to  test  result  and 
later  to  delivery  of  treatment  to  the  patient — 
shrink  from  24  hours  using  the  old-fashioned 
paper  methods  to  four  or  five  hours  with  the 
combination  of  EMR  and  wireless  systems. 

Wireless  makes  productivity  sense  when¬ 
ever  workers  are  mobile  and  work  with 
time-critical  data,  says  Chris  Kozup,  a 
Meta  Group  analyst.  And,  notes  Kathryn 


Korostoff,  president  of  consultancy  Sage 
Research,  the  use  of  wireless  can  also  relieve 
staff  constraints.  “Hospitals  are  always 
understaffed,”  she  says.  “In  the  face  of  eco¬ 
nomic  hardship,  wireless  has  a  payback  sce¬ 
nario.  It’s  not  a  huge  amount  of  capital 
investment.  They’re  clearly  saving  time  for 
doctors  and  nurses,  which  is  their  greatest 
asset.”  Lor  the  users,  “it  really  becomes  a 
part  of  their  job  satisfaction — it  relieves 
stress.  It  has  a  major  effect  on  how  people 
are  satisfied  with  their  job,”  she  adds. 

However,  wireless  and  mobile  technolo¬ 
gies  have  supported  mission-critical  needs 
only  in  the  past  few  years,  and  hospitals 
deploying  the  new  systems  continue  to  wres¬ 
tle  with  the  best  ways  to  deploy  them  and 
integrate  them  into  their  overall  IT  struc¬ 
ture.  While  wireless  network  security  has 
become  a  straightforward  issue  for  CIOs  to 
address,  several  other  technology  hurdles 
continue  to  require  experimentation  and 
greater  heterogeneity  than  many  IT  depart¬ 
ments  would  prefer  to  support. 

Hospitals  are  early  wireless  adopters, 
and  the  issues  they  face  and  the  benefits 
they  achieve  apply  to  any  industry — 
professional  services,  retail,  inventory  ware¬ 
houses — that  has  mobile  workers  within  a 
building,  Korostoff  says. 

AT  THE  CORE:  LAPTOPS  ON  CARTS 

ospitals’  wireless  deployments  typi- 

—  cally  involve  setting  up  802.11b 
_1  LJ  access  points  in  patient  wards,  treat¬ 
ment  facilities  and  in  corridors  in  which 
patients  travel.  Wirelessly  enabled  laptops 
affixed  to  carts  are  rolled  from  bed  to  bed  and 
ward  to  ward  as  needed  so  that  doctors  and 
nurses  can  access  medical  records  and  order 
tests  and  medications  wherever  they  are. 

Usually,  these  shared  laptops  complement 
existing  wired  desktops  installed  at  nurses’ 
stations  and  other  locations  during  earlier- 
generation  attempts  to  digitize  medical 
records.  Wireless  tablets  and  sometimes  PDAs 
often  supplement  these  laptops,  either  to  pro¬ 
vide  staff  with  a  dedicated  device  or  for  use  in 
other  medical  activities. 

Some  hospitals  keep  the  mix  of  devices 


Where  Health  Care  Leads  the  Way 

Hospital  CIOs  pioneer  wireless  voice  and  productivity  apps 

ALTHOUGH  electronic  medical  records  systems  are  driving  wireless  adoption, 
hospital  CIOs  see  many  more  uses  for  that  network  infrastructure  once  it’s  in 
place.  When  it  comes  to  wireless,  hospitals  are  pioneers  in  these  areas. 

Voice  over  wireless.  At  top  of  the  list  is  the  use  of  voice  over  wireless  IP  (VoWIP)  so 
that  staff  members  can  call  each  other  without  having  to  find  a  phone.  In  Springfield, 
III.,  the  Memorial  Medical  Center  and  its  neighboring  St.  John’s  Hospital  are  each 
testing  several  VoWIP  phones  this  summer.  And  St.  Vincent’s  Hospital  in  Birmingham, 
Ala.,  is  testing  a  hands-free  communications  badge  from  Vocera  Communications. 
“The  biggest  educational  issue  is  to  respect  privacy  in  calls,"  says  CIO  Tim  Stet- 
theimer.  The  hospital  also  had  to  adjust  access  point  locations  because  the  badges 
have  a  relatively  small  transmission  range. 

Transcription.  Transcribing  doctors’  dictations  costs  $15,000  to  $30,000  per  year 
for  most  hospital  doctors,  says  Dr.  Bruce  Brown  of  St.  Vincent’s,  which  is  looking  at 
PDA-delivered  dictation.  And  it's  using  tablet  PCs  with  voice  recognition  capabilities. 

At  Ohio  State  University  Medical  Center,  Dr.  Andrew  Thomas  is  looking  forward  to 
dictation  capabilities  on  devices  that  will  transmit  the  audio  files  to  a  transcription 
service,  which  will  then  e-mail  the  text  back. 

Internet  access.  Stettheimer  also  wants  to  provide  wireless  Internet  access  to 
patients  and  visitors.  “I  want  to  be  able  to  do  the  same  thing  as  Starbucks.  I  want  that 
Wi-Fi  label  on  the  door,”  he  says.  “We  recently  upgraded  our  Cisco  access  points  to 
allow  multiple  virtual  LANs  for  that  purpose.  It’s  a  matter  of  taking  care  of  the  entire 
person,  and  [computer  access  is]  an  aspect  of  that  care.” 

Delivery  robots.  Manufactured  by  FMC,  the  40  machines  will  deliver  food,  linens 
and  supplies  throughout  the  Ohio  State  University  Medical  Center,  accessing  their 
task  lists  and  guidance  information  over  the  802.11b  network.  -G.G. 


62  CIO  AUGUST  1,  2003  •  www.cio.com 


limited,  while  others  let  doctors  choose 
almost  anything  to  encourage  usage.  “We 
have  not  found  there  is  one  perfect  answer 
to  how  people  access  information:  wired  PCs, 
laptops  on  carts,  tablets,  PDAs,”  says  St.  Vin¬ 
cent’s  CIO  Stettheimer. 

Consider  four  hospital  deployments: 

■  OSU  Medical  Center  has  more  than 
1,100  medical  staffers  who  care  for  33,000 


matically  after  the  first  users  talk  about  their 
experiences  and  as  the  hospital  runs  out  of 
room  for  stationary  terminals.  The  wireless 
system  cost  $900,000  out  of  the  three-year, 
$30  million  EMR  effort. 

■  St.  John’s  Hospital,  a  block  away  from 
Memorial,  is  focused  on  using  wireless  hand¬ 
held  scanners  to  record  medication  delivery; 
patients’  wristbands,  drug  labels  and  nurses’ 


laptop,  a  PDA  or  tablet  computer.  “It’s  hard 
to  replace  batteries  a  lot — charge,  drain, 
recharge,”  notes  OSU’s  Thomas.  Worse, 
staff  members  tend  not  to  notify  IT  if  a  lap¬ 
top  battery  is  drained  or  if  the  computer  is 
not  working,  since  the  laptops  are  shared 
with  40  other  users  and  thus  no  one’s  direct 
responsibility.  To  encourage  staff  members 
to  plug  notebooks  into  outlets  to  be 


We  take  the  Wal-Mart  approach  to  wireless  investment:  It  must  be  affordable  and  present 
benefits  up  front,  so  it  usually  has  to  be  modular.  -St.  Vincent’s  CIO  Tim  Stettheimer 


inpatients  and  625,000  outpatients  every 
year.  It  has  set  up  220  access  points  and  180 
notebooks  on  carts.  Although  OSU  hasn’t 
tracked  its  wireless  costs  separately,  Enter¬ 
prise  Systems  Director  Phil  Skinner  figures  it 
costs  $600  per  device — whether  it’s  a  PDA, 
access  point  or  wireless  card — including 
setup,  software  and  hardware. 

■  St.  Vincent’s  has  a  similar  setup  of  168 
access  points  and  18  notebooks  for  its  600 
medical  staff  members  (on  average,  40  people 
per  day  access  the  wireless  network).  The  hos¬ 
pital  cares  for  19,000  inpatients  and  sees 
140,000  outpatients  every  year.  St.  Vincent’s 
has  three  tablets  dedicated  to  registration  at 
patient  beds,  so  patients  don’t  have  to  wait  in 
a  lobby,  as  well  as  12  wireless  notebooks  used 
by  technical  and  administrative  staff. 

This  fall,  St.  Vincent’s  will  install  an  elec¬ 
tronic  order-entry  system  for  physicians,  which 
will  be  available  over  100  wireless  PDAs  and 
60  tablets,  as  well  as  more  than  200  existing 
wired  bedside  computers.  Stettheimer  figures 
the  wireless  infrastructure  cost  about  $1  mil¬ 
lion,  out  of  the  hospital’s  $45  million  invest¬ 
ment  in  IT. 

■  Memorial  Medical  Center  in  Springfield, 
111.,  a  teaching  hospital  affiliated  with  Southern 
Illinois  University,  also  took  this  route  for  its 
wireless  deployment.  The  hospital,  whose  550 
physicians  care  for  22,000  inpatients  and 
450,000  outpatients,  has  about  150  access 
points  for  an  initial  six  notebooks.  CIO  O.J. 
Wolanyk  expects  die  number  to  grow  dra- 


badges  are  all  bar-coded.  A  nurse  scans  all 
three  so  that  the  system  can  immediately 
track  which  nurse  gave  which  patient  which 
medication  at  what  time,  says  IS  Director 
Gordon  Lashmett.  St.  John’s  is  implementing 
a  wireless  system  like  Memorial’s  while  it  also 
completes  its  EMR  rollout. 

The  common  theme:  inexpensive  records 
access.  “The  investment  is  not  atrocious,”  says 
St.  Vincent’s  Stettheimer.  “We  take  the  Wal- 
Mart  approach:  It  must  be  affordable  and 
present  benefits  up  front,  so  it  also  usually  has 
to  be  modular,  since  health  budgets  are  very 
tight.” 

Despite  these  fiscal  requirements,  St.  Vin¬ 
cent’s  has  extended  the  wireless  network  to 
cover  the  entire  hospital,  including  the  wing 
housing  doctors’  offices  (already  wired  for 
Ethernet  connections).  Memorial  originally 
planned  on  having  802.1  lb  wireless  access  in 
just  a  few  locations  that  were  difficult  to  wire 
or  where  staff  was  very  mobile,  such  as  in 
patient  wards,  but  Wolanyk  argued  that  it 
made  more  sense  to  make  the  entire  hospital 
wireless — including  the  parking  structures  and 
cafeterias — so  that  doctors  and  nurses  can 
access  information  anywhere. 

DEPLOYMENT  HURDLES 

eploying  wireless  laptops  has  its 
challenges.  Here’s  a  rundown: 

1.  Battery  life.  Surprisingly,  secu¬ 
rity  and  network  management  don’t  top  the 
list.  Battery  life  does,  whether  that  means  a 


recharged,  OSU  will  raise  the  outlets’  height 
as  it  remodels  units,  he  says. 

Battery  life  is  also  an  issue  for  PDAs, 
which  usually  can’t  be  plugged  in  to 
recharge.  Still,  says  St.  Vincent’s  Stettheimer, 
some  physicians  take  them  and  live  with  the 
four-hour  battery  times. 

2.  Security  and  network  management. 
The  typical  IT  concerns  of  security  and 
network  management  are  largely  handled 
by  the  current  generation  of  wireless 
routers  and  gateways.  “Wide  area  wire¬ 
less  doesn’t  require  that  much  expertise. 
The  device  is  doing  the  network  imple¬ 
mentation,”  notes  Mark  Lowenstein, 
head  of  consultancy  Mobile  Ecosystem. 

That  doesn’t  mean  hospitals  simply  plug 
in  access  points.  Instead,  they  connect  access 
points  via  wireless  routers  such  as  those 
from  Bluesocket,  Cisco  Systems,  ReefEdge 
and  Vernier  Networks,  as  well  as  use  man¬ 
agement  software  such  as  those  from 
Wavelink  and  XcelleNet.  And  they  imple¬ 
ment  a  host  of  access  controls:  virtual 
LANs,  policies  for  user  IDs  and  passwords, 
authentication  tools  such  as  MAC  addresses 
(the  unique  media  access  control  ID  for 
each  device  on  a  network),  the  802. lx  wire¬ 
less  authentication  standard,  and  basic  key- 
oriented  encryption  such  as  the  wired 
equivalency  protocol  (WEP).  Some  hospi¬ 
tal  network  managers  also  use  intrusion 
detection  software  and  hardware. 

3.  Network  performance.  Even  with  secu- 
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rity  vigilance,  traditional  network  imple¬ 
mentation  issues  remain.  For  example,  the 
use  of  routers  and  virtual  LANs  can  intro¬ 
duce  some  delays  as  users  roam  among 
access  points,  notes  Stettheimer:  Smaller 
devices  such  as  PDAs  that  have  less  powerful 
radios  to  save  on  battery  life  are  more  likely 
to  drop  connections  as  a  user  roams,  he  says, 
while  some  access  points  don’t  reliably  for¬ 
ward  user  log-in  information  to  the  next 
access  point  as  the  person  roams. 

Reconfiguring  access  points’  radio  power 
levels  solved  the  first  issue,  while  upgrading 
access  point  firmware  addressed  the  other. 
Stettheimer’s  staff  also  had  to  adjust  LAN 
settings  to  optimize  traffic  between  the  wire¬ 
less  and  wired  segments  to  prevent  signal 
gaps  that  caused  firewalls  to  reject  some 
roaming  users. 

Ironically,  it’s  the  use  of  standard  network 
security  tools  that  can  create  hand-off  issues 
among  wireless  access  points,  says  Meta 
Group’s  Kozup.  The  802.11b  standard 
allows  for  and  enforces  efficient  roaming,  he 
says,  but  the  use  of  security  mechanisms  sep¬ 
arates  the  unified  802.11  networks  into  seg¬ 
ments.  The  need  to  reauthenticate  users 
when  they  pass  from  one  network  segment 
into  another  can  lead  to  service  disruptions. 
Some  of  this  may  get  simpler  as  wireless 
standards  are  updated,  Kozup  says. 

4.  Access-point  placement.  This  is  not  so 
much  a  hurdle  as  an  important  considera¬ 
tion.  Wolanyk  of  Memorial  Medical  says  he 
originally  thought  he  would  need  300  access 
points  to  provide  wireless  network  coverage. 
A  radio-placement  consultant  helped  him  cut 
that  in  half,  and  in  the  process  paid  for  its 
fee,  he  adds. 

NOT  READY  FOR  PRIME  TIME 

1 =“ZI  ablet  PCs  and  slate  computers  are  all 
on  hospitals’  radars  because  they  are 
most  akin  to  familiar  notepads,  but  none 
are  yet  appropriate  for  deployment. 

“We  looked  at  Fujitsu  and  ViewSonic  slates, 
but  the  battery  is  gone  in  two  hours,”  recalls 
OSU’s  Thomas.  “When  the  battery  died,  you 
had  to  reload  the  drivers  for  the  device  because 
everything  is  in  memory.” 


Health-Care  IT  |  Mobile  Medicine 

St.  Vincent’s  is  testing  20  tablets  from  dif¬ 
ferent  manufacturers.  Whatever  tablets  Stet¬ 
theimer  selects,  he  will  not  store  data  on 
them,  even  if  he  takes  advantage  of  their 
processing  power  to  offload  work  from  the 
servers.  That’s  already  the  policy  for  PDAs: 
no  data  stored  on  the  devices.  Instead,  he 
uses  XML  on  the  handhelds  to  query  the 
EMR  system  for  information  that  is  read¬ 
only  on  the  device  screen. 

ONGOING  EXPERIMENTATION 

r\  l~~\  n  ireless  technology  is  still  new 
\  A  /  anc*  ev°lving>  so  hospital  wire- 
\—l  \—J  less  systems — just  like  their  EMR 
systems — will  evolve  for  years,  and  hospi¬ 
tals  will  choose  different  paths  for  their 
deployments. 

“We’re  right  there  on  the  edge.  We  can 
see  it,  but  it’s  not  quite  there,”  says  Stet¬ 
theimer  about  personal  hospital  informa¬ 
tion  technology. 

Meanwhile,  doctors  are  used  to  chang¬ 
ing  their  diagnostic  technology  annually, 
St.  Vincent’s  Brown  says.  At  the  same  time, 
a  more  technically  savvy  crop  of  doctors  is 
entering  the  field,  adds  Brown,  who  prides 
himself  on  finding  technology  for  doctors 
faster  than  his  IT  department.  (OSU,  for 
example,  will  give  entering  medical  students 
the  new  Palm  Tungstens  this  year,  mostly 
to  try  out  the  new  audio  capability  for 
dictation.) 

It  will  take  an  openness  to  experimenta¬ 
tion  by  both  users  and  IT  managers  to 
ensure  that  wireless  and  mobile  technolo¬ 
gies  deliver  on  their  promise  in  today’s 
increasingly  IT-based  medical  practice.  130 


Galen  Gruman  is  a  San  Francisco-based  freelance 
writer.  Send  your  comments  to  letters@cio.com. 
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CIOs  are  paying  higher  prices  for  software 
while  small  inventors  and  industry  giants 
threaten  each  other  with  software  patents. 
Has  the  venerable  patent  system  finally 
broken  down? 


NOW  THAT  THE  COURTS  HAVE  BEGUN  RESPECTING  SOFTWARE  PATENTS,  BIG  SOFTWARE  COMPANIES 


have  rushed  to  patent  everything  they  have.  Some  argue 
that  this  stampede,  rather  than  protecting  innovation, 
actually  harms  it,  reducing  choice  and  raising  costs  for 
the  CIO.  They  say  the  software  industry  is  so  complex 
and  ubiquitous  that  our  patent  system  isn’t  equipped  to 
protect  software  developers  and  CIOs.  Instead,  it  rewards 
big  companies  that  acquire  broad  software 
patents,  charge  competitors  hefty  license 
fees,  bleed  the  market  dry  of  choice  and  use 
their  deep  pockets  to  defend  their  vast  patent 
portfolios  in  court. 

Defenders  of  the  system  say  that  while  we 
have  indeed  hit  a  bad  patch— with  too  many 
broad  patents  and  too  much  litigation— we’re 


simply  seeing  history  repeat  itself.  There  is  always  a 
period  of  turmoil  when  a  “new"  technology  is  patented, 
with  a  flurry  of  patents  and  court  fights  until  things  settle 
down  and  we  see  that  patents  do  what  they  have  always 
done:  reward  innovators  for  their  intellectual  curiosity, 
and  protect  them  from  copycats. 

One  thing  is  clear:  The  U.S.  Patent  and 
Trade  Office  (USPTO)  is  overwhelmed,  both 
by  the  volume  and  complexity  of  software 
patent  applications.  We  asked  two  experi¬ 
enced  patent  attorneys  to  argue  the  two 
sides  of  the  case  so  that  you  can  decide:  Is 
the  patent  system  breaking  down,  or  is 
patience  a  virtue? 


Reader  ROI 

►  How  patents  affect 
the  cost  of  your 
software 

►  Why  you  need  a 
patent  portfolio 

►  What  you  can  do  to 
improve  the  patent 
system 
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Intellectual  Property 


Patents:  An  Expensive  Tax  on  the  CIO  BY  LAWRENCE  ROSEN 


SOFTWARE  PATENTS  cost 
you  money.  Like  taxes,  they 
skim  from  your  profit  mar¬ 
gins,  but  in  this  case  the  fees 
go  to  pay  for  other  compa¬ 
nies’  intellectual  property. 

For  example,  your  e-mail  program,  Inter¬ 
net  browser  and  word  processor  (all  pat¬ 
entable)  may  carry  a  5  percent  to  10  percent 


patent  license  fee.  If  patented  software  is 
embedded  in  your  products  or  services  and 
the  patent  holder  takes  you  to  court,  you 
could  find  yourself  paying  the  same  markup. 
Most  important,  what  if  this  expense  comes 
as  a  surprise,  when  a  patent  holder  demands 
royalties  for  a  patent  you  didn’t  even  know 
existed?  Flow  would  a  sudden  5  percent 
to  10  percent  price  hike  in  your  product 


affect  your  sales,  your  profits? 

That  example  is  not  hypothetical.  I  rep¬ 
resented  a  small  computer  hardware  com¬ 
pany  that  was  recently  sued,  along  with 
210  other  companies,  for  infringement  of  a 
1985  software  patent  for  processing  color 
images  for  scanners.  My  client  was  unaware 
of  the  patent.  The  plaintiff  sought  damages 
in  the  form  of  a  “reasonable  royalty”  going 

Continued  on  Page  68 
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Patents:  A  Small  Price  to  Pay  for  Progress  BY  MARK  RADCLIFFE 


E  BARBED  WIRE  may  not 
seem  to  have  much  to  do  with 
software,  but  both  stirred  a 
lot  of  controversy  when  they 
were  first  patented.  In  the 
19th  century,  there  were  570  different  patents 
on  barbed  wire,  and  the  legal  fights  between 
the  different  patent  owners  lasted  for  years. 


Yet  the  Western  pioneers  had  plenty  of 
barbed  wire  to  stake  their  claims. 

Today,  we’re  seeing  a  similar  controversy 
with  software  patents.  In  the  early  stage  of 
any  new  technology’s  development,  the 
scope  of  some  issued  patents  may  be  overly 
broad.  Yet  such  problems  have  all  been 
resolved  over  time,  and  inventors  have 


always  been  rewarded  for  their  innovations 
while  being  protected  from  those  who  want 
to  co-opt  their  work. 

For  CIOs,  the  issue  is  not  whether  patents 
should  be  granted  for  software  but  whether 
anything  can  be  done  to  improve  the  quality' 
of  the  granted  patents.  The  problem  relates 
more  to  the  examining  process  in  the  USPTO 


Continued  on  Page  68 
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An  Expensive  Tax  on  the  CIO 

Continued  from  Page  67 

back  six  years.  Guess  who  will  pay  that  roy¬ 
alty?  Customers.  As  far  as  I  know,  the  law¬ 
suit  is  still  going  on,  at  a  probable  cost  in 
attorneys’  fees  alone  of  $100K  per  month. 

Big  software  companies  create  portfolios 
of  thousands  of  patents  (for  example,  IBM 
has  more  than  27,000;  Microsoft  has  2,400) 
designed  to  legally  monopolize  innovation. 
Every  large  company  now  seeks  a  patent 
portfolio  relevant  to  its  areas  of  business  to 
use  as  a  bargaining  chip  with  competitors. 
They  stack  their  patent  portfolios  on  confer¬ 
ence  room  tables,  weigh  them  against  their 
competitors’,  and  negotiate  cross-licensing 
fees.  Small  startups  usually  don’t  have  the 
resources  to  build  a  stack  of  patents  and  may 
avoid  the  market  altogether,  limiting  choice 
for  CIOs.  Regardless,  this  defensive  rush  to 
the  patent  office  is  driving  up  costs — and 
therefore,  prices — for  everyone  involved. 

When  CIOs  buy  software,  they  often  seek 


A  Small  Price  to  Pay  for  Progress 

Continued  from  Page  67 

than  to  the  appropriateness  of  patents  for 
software.  CIOs  who  are  concerned  about 
overly  broad  patents  can  lobby  for  more 
thorough  examination  of  patent  applications 
by  the  USPTO  or  request  that  an  already 
established  patent  be  reexamined,  for  exam¬ 
ple.  And,  in  fact,  the  USPTO  recently  imple¬ 
mented  a  program  for  closer  review  for 
business  method  patent  applications  (“one- 
click”  ordering  on  a  website,  for  example) 
because  of  public  concern  about  overly  broad 
protection  for  business  methods. 

There’s  a  good  reason  your  software  ven¬ 
dors  take  out  a  patent:  They  spend  mil¬ 
lions — even  billions — to  develop  their 
products.  Patents  and  licensing  fees  are  some 
of  the  ways  they  get  compensated  for  their 
efforts.  Patent  license  fees  may  push  up  the 
cost  of  software  to  CIOs,  but  those  fees  don’t 
begin  to  compensate  companies  for  the 
money  they  put  into  software  development. 

That  said,  CIOs  shouldn’t  simply  ignore 


patent  indemnification — the  software  com¬ 
pany  agrees  to  fight  any  infringement  claims 
against  you  as  well  as  itself — but  costs  are 
capped  by  the  vendor,  most  of  whom  have 
shallow  pockets.  And  no  indemnity  provi¬ 


sion  would  ever  cover  you  if  you  combined 
patented  technology  with  your  own  systems. 

Worse,  the  only  way  to  know  whether 
you’ve  violated  specific  patents  is  to  evaluate 
those  patents  one  by  one.  But  the  very  struc- 


Patent,  Copyright  and  Trade  Secret— 
What’s  the  Difference? 

THE  INTELLECTUAL  PROPERTY  in  software  can  be  protected  three  ways:  patents, 
copyrights  and  trade  secrets.  Patents  protect  “inventions”  that  are  useful,  nonobvious 
and  novel,  and  must  be  approved  by  the  U.S.  Patent  and  Trademark  Office.  The  scope  of 
the  final  patent  may  be  quite  different  than  the  initial  application. 

Copyright  law  applies  to  “works  of  authorship”  that  are  fixed  in  a  tangible  medium  of 
expression  (such  as  a  CD  or  a  book),  and  applies  automatically  (a  filing  with  the  U.S. 
Copyright  Office  is  required  prior  to  bringing  a  lawsuit).  Thus,  the  code  of  virtually  all 
software  is  automatically  protected  by  copyright.  Copyright  prohibits  the  reproduction, 
distribution,  modification,  public  performance  and  public  display  of  software  that  is 
“substantially  similar”  to  the  original  software.  If  the  software  is  protected  only  by 
copyright,  anyone  can  avoid  paying  a  license  fee  by  re-creating  the  software  from 
scratch  without  copying  it.  That  is  not  usually  practical,  of  course,  but  it  does  set  some 
limits  on  what  copyright  holders  can  demand  in  their  software  licenses.  If  the  price  of 
existing  software  is  too  high,  competitors  will  simply  rewrite  the  software  from  scratch. 

Finally,  trade  secret  law  protects  any  information  that  is  not  “commonly  known”  and 
which  the  company  has  taken  reasonable  steps  to  keep  in  confidence.  The  protection 
is  more  limited  than  patent  and  copyright  protection:  Trade  secret  law  prevents  only 
misappropriation,  which  means  wrongful  taking.  Trade  secret  law  could  protect 
secrets  in  the  source  code  of  the  software,  for  example.  -L.R.  and  M.R. 


the  patent  licensing  issue  and  pay  up  when¬ 
ever  asked.  They  should  develop  (or  acquire 
through  purchase)  a  defensive  portfolio  of 
software  patents  to  use  as  a  bargaining  chip 
when  faced  with  another  company’s  patents. 
By  offering  to  license  your  patents — or  by 
threatening  to  assert  your  patents — it  may  be 
possible  to  avoid  simply  giving  in  to  their 
demands  or  fighting  a  lengthy  and  costly  legal 
battle.  Sure,  acquiring  a  patent  portfolio  is  an 
extra  cost  and  a  management  headache,  but 
it  beats  going  to  court:  An  American  Bar 
Association  study  estimates  that  an  average 
patent  case  costs  each  side  $2  million  in  attor¬ 
ney  and  expert  fees  tlirough  the  end  of  trial, 
not  including  the  cost  of  an  appeal. 

CIOs  also  need  to  understand  misconcep¬ 


tions  about  software  patents  so  that  they  can 
act  as  informed  advisers  to  the  business.  Here 
are  three  of  the  biggest  myths. 

Myth  #1  PATENTS  FAVOR  LARGE  COR¬ 
PORATIONS  AND  PENALIZE  SMALL 
COMPANIES  AND  INDIVIDUALS.  Without 
patents,  new  companies  may  not  be  able  to 
establish  themselves  in  the  marketplace  or 
deter  large  competitors  from  providing  similar 
functionality.  For  example,  small  software 
vendor  Stac  Electronics  stopped  giant 
Microsoft  in  its  tracks  in  1993,  after 
Microsoft  included  file  compression  func¬ 
tionality — which  had  been  patented  by  Stac — 
in  Windows.  A  court  injunction  prevented 
Microsoft  from  selling  Windows,  and  within 
a  week  Microsoft  settled  the  lawsuit  by  pay- 


ture  of  the  software  industry  makes  evaluat¬ 
ing  the  torrent  of  new  patents  each  year 
impossible.  Software  is  complex  and  ubiqui¬ 
tous.  Developers  from  around  the  world 
cooperate  to  write  software — especially  in  the 
open-source  community — but  patents  are 
national  and  vary  widely  from  country  to 
country.  The  analysis  task  is  monumental. 

Sometimes  the  cost  of  patents  is  even 
greater  than  a  licensing  fee — it  could  mean 
shutting  down  the  business.  That’s  because  a 
patent  owner  is  not  required  to  license  his 
patent.  Kodak  had  to  shutter  its  instant  cam¬ 
era  business  when  patent  owner  Polaroid 
felt  threatened  by  competition.  Could  your 
programming  budget  survive  a  sudden 
requirement  to  design  around  a  software 
patent,  assuming  it  is  technically  feasible? 

Please  understand  that  Pm  not  arguing 
against  patents — they  are  here  to  stay.  But  I 
do  believe  that  the  system  for  software  and 
business  method  patents  is  even  more  bro¬ 
ken  than  in  other  industries.  Software  tech¬ 


nology  is  evolving  far  more  rapidly  than 
most  other  fields,  with  product  development 
and  marketing  cycles  measured  in  months 
rather  than  years. 

Even  the  USPTO  can’t  keep  up.  It  is  try¬ 
ing  valiantly  to  improve  the  analysis  of 
patent  applications,  but  to  do  that,  of 
course,  it  has  to  compete  for  skilled  workers 
who  can  make  much  more  money  in  the  pri¬ 
vate  sector. 

So  what  can  be  done?  One  of  the  goals  of 
patent  holders  is  to  monopolize  innovation 
in  an  industry — indeed,  it’s  perfectly  legal. 
But  thoughtful  people  are  now  proposing 
that  monopolies  be  more  limited  or  disal¬ 
lowed  altogether  for  essential  technologies 
such  as  drugs  for  life-threatening  diseases. 
The  same  limitations  could  be  applied  to 
essential  software  and  business  methods. 

Shortening  the  current  20-year  term  of 
patents  would  also  help.  With  technology 
changing  so  rapidly,  few  patent  holders 
would  be  hurt,  and  it  would  embolden  every¬ 


one  to  innovate  more  quickly  and  spend  less 
time  playing  defense.  While  Congress  is  at  it, 
it  should  make  patent  holders  license  essential 
technology  to  anyone  who  wants  to  use  it. 

The  challenge  is  to  find  a  proper  balance 
between  the  rights  of  companies  to  obtain 
patents  and  the  rights  of  software  users  to 
access  the  basic  building  blocks  of  the 
information  economy.  Today,  the  balance  is 
not  there.  HE! 


Lawrence  Rosen  is  founding  partner  of  Rosenlaw- 
,com,  a  Redwood  City,  Calif.-based  technology  law 
firm  ( www.rosenlaw.com ),  and  is  corporate  secre¬ 
tary  and  general  counsel  of  Open  Source  Initiative 
( www.opensource.org ). 


Share  Your  Opinion 


Have  you  run  up  against  patent  trouble  with 
software  vendors?  Go  to  the  ADD  A  COMMENT 

box  on  the  online  version  of  this  article,  and  let 
us  know  what's  on  your  mind.  Find  "The  Great 
Debate  Over  Software  Patents"  online  at 

www.cio. com/080103. 

cio.com 


ing  Stac  $120  million.  In  addition,  antitrust 
laws  severely  limit  the  manner  in  which  com¬ 
panies  can  use  their  patents.  For  example, 
requiring  the  purchase  of  an  unpatented  prod¬ 
uct  to  obtain  a  patented  product  is  illegal. 

Myth  #2  PATENTS  ARE  TOO  BROAD 
AND  COVER  THE  ENTIRE  SOFTWARE 
PROGRAM.  Because  patents  require  sufficient 
disclosure  of  an  invention  to  enable  others  to 


practice  it,  there  is  a  misconception  that  they 
cover  everything  disclosed.  Patent  protection 
extends  only  to  what  is  claimed,  not  to  every¬ 
thing  in  the  entire  software  program  (or  even 


all  of  the  material  in  the  patent).  Software 
developers  can  learn  about  advances  in  soft¬ 
ware  through  reviewing  patents  and  can  use 
those  advances  in  their  own  products  if  they 
are  not  claimed  in  those  patents. 

Myth  #3  SOFTWARE  IS  INTANGIBLE 
AND  IS  DIFFERENT  FROM  OTHER  TECH¬ 
NOLOGIES.  Software  that  controls  the 
operation  of  a  computer  is  certainly  an 


“intangible”  process,  but  no  less  protectable 
than  other  more  tangible  processes,  such  as 
the  manufacture  of  pharmaceutical  products 
or  semiconductors.  It  is  not  the  software  code 


that  is  patentable.  Rather,  the  processes  that 
are  performed  by  a  computer  executing  the 
code  are  what  can  be  patented.  Moreover, 
most  “software”  functions  can  be  performed 
in  special  purpose  hardware — which  has  long 
been  considered  patentable.  The  choice  of 
one  or  the  other  is  relatively  arbitrary. 

Innovation  in  software  is  no  less  worthy 
of  patent  protection  than  other  technologies 
traditionally  protected  by  patents.  CIOs 
need  to  be  prepared  to  advise  their  compa¬ 
nies  on  how  to  protect  their  important  inno¬ 
vations.  And  they  need  to  question  their 
vendors  closely  when  purchasing  software. 
A  nasty  patent  suit  may  force  the  vendor  to 
divert  substantial  resources  and  may  even 
make  the  product  unavailable.  A  vendor’s 
patent  strategy  and  its  risks  should  be  as 
much  a  part  of  the  due  diligence  process  as 
ROI  or  maintenance  fees.  HEJ 


Mark  Radcliffe  is  a  partner  with  Gray,  Cary,  Ware  & 
Freidenrich  in  Palo  Alto,  Calif. 


CIOs  shouldn’t  simply  ignore  the  patent 
licensing  issue  and  pay  up  to  any  vendor 
that  demands  fees.  They  should  develop 
(or  acquire)  a  defensive  portfolio  of  soft¬ 
ware  patents  to  use  as  a  bargaining  chip. 
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Reader  Q&A 


How  comfortable  do  you 
find  the  hot  seat?  E-mail 
Leadership  and  Management 
Editor  Edward  Prewitt  at 
hotseat@cio.com. 


Sandra  Hofmann  is  used  to  playing 
diverse  roles.  She  spent  several  years  teach¬ 
ing  children  with  learning  disabilities 
before  putting  in  14  years  in  management 
at  Big  Blue.  When  not  gardening  at  her 
rural  home,  she  enjoys  target-shooting 
with  her  Smith  &  Wesson  686  revolver. 
And  as  CIO  of  Mapics,  a  $128  million 
maker  of  manufacturing  software,  she  has 
to  understand  technology  intimately,  but 
she  also  carries  a  very  different  kind  of 
title:  Chief  People  Officer. 

Before  you  snicker  at  this  squishy 
moniker  or  feel  sorry  for  Hofmann,  hear 
what  she  has  to  say  about  combining 
technology  and  HR  leadership  in  a  single 
executive:  “A  software  company’s  great¬ 
est  asset  is  its  intelligence,  and  that  asset 
resides  in  people.  So  HR  and  IT  are 
really  two  sides  of  the  same  coin.” 

In  fact,  Hofmann  earned  the  nickname 
Chief  People  Officer  around  the  office 
before  it  ever  became  official.  She  attrib¬ 
utes  her  appreciation  of  the  effects  that 
IT — particularly  IT-driven  change — can 
have  on  people  to  her  background  in  edu¬ 
cation.  “Being  a  CIO  represents  being  a 
change  agent,  being  a  model  for  others, 
establishing  infrastructure,  challenging 
processes,  enabling  people  to  act — doesn’t 
that  describe  every  great  teacher  you’ve 
ever  had?”  Hofmann  says  in  a  gentle  but 
cheerful  voice  that  sounds  just  like  every 
great  teacher  you’ve  ever  had. 

That  lesson  plan  appears  to  be  just 
what  Mapics  needed.  Hofmann  joined 
the  company  in  July  2000  as  vice  presi¬ 
dent  and  general  manager  of  its  Woburn, 
Mass. -based  business  unit.  But  when 
Mapics  stumbled  as  the  recession  took 
hold,  President  and  CEO  Dick  Cook 
brought  Hofmann  down  to  headquarters 
in  the  Atlanta  suburb  of  Alpharetta,  Ga., 


to  become  CIO  of  the  entire  company 
and  help  keep  the  formerly  high-flying 
enterprise  aloft.  Late  last  year,  Hofmann 
added  the  CPO  title  to  her  business  card. 
The  dual  labels  reflect  her  huge  role  in 
guiding  all  of  Mapics’  750  employees 
through  several  major  changes  within  a 
short  span  of  time:  reorganizing  the 
company,  taking  a  sizable  chunk  of  the 


Sandra  Hofmann,  CIO  and  chief  people 
officer  of  Mapics,  finds  IT  and  HR  to  be 
a  natural  pair. 


workforce  completely  virtual  and  intro¬ 
ducing  offshore  outsourcing. 

That’s  a  lot  of  change  for  any  organi¬ 
zation  to  digest.  Yet  at  Mapics,  Hofmann 
not  only  assisted  in  the  transformation 
but  also  improved  IT  service.  Her  boss 
credits  Hofmann’s  success  to  her  mastery 
of  many  trades.  “Sandy  has  lots  of  expe¬ 
rience  working  in  a  wide  variety  of  func¬ 
tions  and  acting  in  a  lot  of  different 
roles,”  says  Cook.  “As  a  result,  she’s  the 
consummate  manager — one  who  under¬ 
stands  the  business  very  well  but  also  has 
an  incredible  knack  with  people.” 
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Digital  Document 
Security  and  IT: 
Everything  you 
need  to  know. 

Qt  What  are  the  most  significant 
•  digital  copier  security  issues? 

A#  Various  copier  print  controllers 
•  are  actually  servers  that  queue 
and  permanently  store  multiple 
document  files,  providing  administrator 
access  to  the  documents.  At  a 
minimum,  most  digital  copiers  retain 
the  last  document  processed;  some 
even  retain  multiple  documents 
totaling  hundreds  of  pages.  Others 
redirect  print  jobs  when  the  printer  is 
busy  or  jammed,  making  "denial  of 
service"  attacks  possible. 

Q#  How  does  Sharp  protect  the 
•  network  interface? 

A#  The  Sharp  Ethernet  card  allows 
•  administrators  to  restrict  access 
and  disable  unnecessary  protocols. 
With  this  network  card,  the  Sharp 
digital  copier  is  essentially  protected 
by  its  own  firewall. 

Q#  How  can  you  be  sure  that 
•  security  products  actually 
perform  as  claimed? 

A#  The  Common  Criteria  program 
•  —administered  by  the  U.S. 
National  Security  Agency  and  the 
National  Institute  of  Standards  and 
Technology — evaluates  security 
solutions.  Products  that  are  validated 
under  the  program  meet  security  levels 
consistent  with  ISO  1 5408  methodology. 

Q#  How  can  Sharp  improve  IT 
•  security? 

A#  Sharp  offers  print  privacy 
•  solutions  designed  to  restrict 
unauthorized  personnel  from  seeing 
confidential  materials.  Copier  access 
can  be  controlled  and  monitored, 
while  documents  retained  in  printer/ 
copier/scanner/fax  memory  are 
immediately  cleared  to  eliminate 
unauthorized  access. 

sharpusa.com 
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Even  so,  Hofmann 
had  her  work  cut  out 
for  her.  She  was  part 
of  a  three-person  team 
charged  not  only  with 
completely  reorganiz¬ 
ing  the  structure  of  Mapics  but  also  with 
modifying  the  way  some  employees  work 
and  deciding  whether  others  would  work 
at  all. 


Thinking  Without  the  Box 

In  late  2001,  the  reorg  team  began  its 
work.  Whereas  everything  had  previ¬ 
ously  been  centered  around  product 
lines — with  each  line  of  business  having 
its  own  IT,  HR,  finance  and  other 
departments — the  team  consolidated 
functions.  The  old  structure  had  worked 
just  fine  in  the  go-go  ’90s,  but  the  eco¬ 
nomic  downturn  had  revealed  its  flaws 
fast.  “We  knew  [the  reorganization] 
made  good  business  sense  and  excellent 
operational  sense,  but  we  had  to  spend  a 
lot  of  time  talking  to  employees  about 
it,”  Hofmann  says.  After  countless  meet¬ 
ings,  surveys  and  one-on-one  conversa¬ 
tions,  employees  began  to  buy  in. 
“Developers,  for  example,  realized  they 
liked  being  with  other  developers  where 
their  line  managers  actually  knew  what 
their  jobs  were,”  she  says. 

But  the  changes  were  just  beginning 
at  Mapics.  During  reorg  planning,  exec¬ 
utives  began  to  think  not  only  outside 
the  silos  that  had  once  existed  at  the 
company  but  also  outside  its  physical 
premises.  “We  started  saying,  ‘How  big 
an  office  do  we  really  need?’  and  by  the 
end  of  the  day  we  were  saying,  ‘Why  do 
we  need  an  office  at  all?’”  Hofmann 
remembers.  Closing  some  offices  and 
sending  people  home  would  save 
$500,000  in  real  estate  costs  a  year.  But 
even  though  Mapics  was  relatively  skilled 
in  providing  support  to  telecommuters — 
every  day  a  third  of  its  employees  were 
on  the  road  or  working  at  home — there 
always  was  an  actual  office  to  go  back 


to.  “There  were  tons  of  issues  to  address, 
but  cost  alone  demanded  that  we  take  a 
look  at  it,”  Hofmann  says. 

In  late  2001,  she  announced  a  proposal 
to  take  the  Massachusetts  office  virtual, 
and  immediately  afterward  she  began 
hearing  from  all  sides.  “Talk  about  a  dra¬ 
matic  change  in  people’s  lives!  Some  of 
these  people  had  been  coming  into  this 
office  for  10  years,”  says  Hofmann, 
chuckling  about  hearing  from  as  many 
angry  spouses  as  anxious  employees.  Hof¬ 
mann  and  her  staff  kept  lines  of  commu¬ 
nication  open — from  setting  up  FAQs  on 
the  intranet  to  meeting  in  person  for  train¬ 
ing  and  orientation — as  they  began  the 
three-month  transition  in  January  2002. 

By  March,  all  84  Massachusetts-based 
employees  were  working  at  home.  Inter¬ 
est  in  the  virtual  office  program  has 
spread  since  then.  After  Mapics’  recent 
acquisition  of  Columbus,  Ohio-based 
software  company  Frontstep,  several  of 
the  newly  added  employees  asked  to  go 
virtual,  which  Hofmann  was  only  too 
happy  to  approve.  (Despite  the  success  of 
the  program,  there  are  no  plans  to  shutter 
the  headquarters  building;  centralized 
services  such  as  IT,  finance  and  HR 
require  a  central  office,  Hofmann  says.) 

A  third  big  change  at  Mapics  was 
already  under  way.  Hofmann  had  begun 
exploring  offshore  outsourcing  to 
address  fluctuating  development  staff 
needs.  It  was  the  most  controversial  and 
unpopular  proposal  yet.  “Many  individ¬ 
uals  in  development  knew  outsourcing’s 
checkered  past,”  Hofmann  says.  “There 
was  a  lot  of  angst  concerning  what  the 
quality  of  the  work  would  be  and  how 
to  manage  a  process  when  the  team  is 
an  ocean  away.” 

Hofmann  tried  to  address  such  con¬ 
cerns  by  conducting  two  pilots  with  an 
Indian  firm.  The  tests  went  well  enough 
that  in  January  2003,  she  announced  a 
deal  with  Indian  company  HCF  Tech¬ 
nologies,  which  took  over  all  develop¬ 
ment  and  maintenance.  However, 
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How  secure  is  your  digital  information? 


Protect  your  information  with  the  Data  Security 
Kit  from  Sharp.  Financial  facts,  personnel  records, 
customer  lists:  networked  copiers/printers  process 
sensitive  information  every  day.  Unfortunately,  their 
hard  drives  can  also  be  accessed  via  the  network, 
contributing  to  $60  billion  worth  of  information 
theft  every  year.*  To  protect  this  weak  link  in  your 


corporate  security,  we've  created  our  Data  Security 
Kit.  It's  the  first  copier  and  printer  protection  to 
be  validated  by  Common  Criteria,  a  government- 
sponsored  program,  and  it's  available  only  with 
our  Digital  IMAGER™  series  of  copiers/printers. 
Sharp's  Data  Security  Kit.  Enhanced  information 
protection  at  your  fingertips,  sharpusa.com/security 
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The  Management  Toolkit 


architecture,  design, 
training,  information 
development  and  qual¬ 
ity  assurance  work 
stayed  at  Mapics.  The 
contract  lowered  Hof¬ 
mann’s  software  costs  by  half. 

Yet  Mapics  still  needed  to  cut  more 
costs.  With  the  outsourcing  arrangement 
in  place,  the  company  laid  off  12  percent 
of  the  software  engineering  staff.  “The 
world  may  have  gotten  used  to  regular 
layoffs,  but  we’d  never  had  to  do  it.  It 
was  very,  very,  very  hard,”  says  Cook. 

Turning  on  the  Tech  Channel 

While  the  enterprise  was  working  through 
the  trifecta  of  changes,  its  IT  department 
wasn’t  faring  as  well.  “I  made  the  mistake 
of  walking  down  the  halls  and  listening,” 
Hofmann  jokes.  What  she  heard  wasn’t 
good.  “My  organization,  which  had  been 
pulled  together  very  quickly,  did  not  have 
a  service  attitude.” 

In  trying  to  change  the  mind-set  of  her 
staff,  Hofmann  called  on  her  old  teaching 
skills.  “People  with  learning  disabilities 
are  extremely  bright,  but  one  of  their  pri¬ 
mary  learning  channels  is  not  function¬ 
ing,”  Hofmann  says.  “In  IT,  you  have 
individuals  who  excel  in  certain  areas  but 
not  in  others.  Programmers,  for  example, 
aren’t  always  the  most  socialized;  they’re 
used  to  being  the  geeks  in  the  closet.  And 
you  may  have  to  capture  their  attention 
in  different  ways.”  (Careful  not  to  insult 
her  staff,  Hofmann  adds,  “I’m  not  saying 
all  adults  are  children.  But  sometimes  it’s 
important  to  look  for  the  child  in  an 
adult.”) 

So  she  approached  staffers  with  some¬ 
thing  familiar  to  them — data  and  infor¬ 
mation.  She  conducted  a  companywide 
survey  on  the  perception  of  IT  and 
handed  the  staff  the  raw  results,  putting 
some  of  her  employees  face-to-face  with 
complaints  that  named  them  directly. 

“We  got  slammed,”  remembers  Jim 
Overdorff,  director  of  enterprise  techni- 


Pulling  Out  All  the  Stops 
to  Get  Restarted 

Balanced  Scorecard,  benchmarking, 
core  competencies— companies’  use 
of  these  management  tools  and 
techniques  and  many  others  has 
boomed  since  the  start  of  the  reces¬ 
sion  in  2000,  according  to  a  survey 
conducted  by  consultancy  Bain. 

On  average,  companies  in  the 
survey— which  was  mailed  to  CXOs  at 
companies  of  all  sizes  and  industries 
worldwide— used  16  out  of  25  tools 
and  techniques  in  2002,  versus  10  out 
of  the  same  25  in  2000.  The  top  three 
were  strategic  planning,  benchmark¬ 
ing,  and  mission  and  vision  state¬ 
ments,  all  used  by  more  than 
80  percent  of  the  respondents. 

The  turn  to  management  tools  is 
driven  by  a  search  for  profits,  says 
Darrell  Rigby,  a  Bain  director  who 
launched  the  annual  “Management 
Tools  and  Trends”  survey  in  1993. 
“Now  that  they’re  squeezed,  people 
are  using  these  methods  in  search  of 
growth,”  he  says. 

The  two  tools  showing  the  sharpest 
increases  in  usage  are  of  particular 
interest  to  CIOs:  78  percent  of  the 
708  senior  execs  responding  to  the 
survey  said  they  used  CRM  in  2002, 
up  from  35  percent  in  2000;  and 
62  percent  of  respondents  applied 
knowledge  management  methods  in 
'02,  compared  with  32  percent  in  2000. 

The  popularity  of  CRM  was  the 
survey’s  biggest  surprise,  in  Rigby’s 
view.  "Some  people  thought  CRM 
would  follow  the  route  of  reengineer¬ 
ing,”  he  says.  But  CRM  is  proving 
effective  at  many  companies,  as 
indicated  by  rising  satisfaction  levels 
among  survey  respondents— from  well 


below  average  in  the  2000  survey  to 
just  about  average  in  2002.  Rigby 
attributes  this  increase  to  greater 
sophistication  in  companies’  use  of 
CRM.  Rigby  notes  that  many  execu¬ 
tives  use  a  low-tech  definition  for  CRM 
rather  than  automatically  equating  it 
with  software.  “CRM  is  almost  becom¬ 
ing  the  new  vocabulary  for  a  customer- 
focused  strategy,”  he  says. 


The  survey's  signals  are  mixed  on 
knowledge  management.  KM  regis¬ 
tered  some  of  the  lowest  satisfaction 
rates.  “When  people  are  measuring  the 
net  benefits,  they’re  saying  the  bene¬ 
fits  aren’t  as  high  as  they  thought  they 
would  be,  and  the  costs  are  10  times  as 
high,”  Rigby  comments.  Even  so,  the 
use  of  KM  increased  among  survey 
respondents,  in  line  with  the  general 
upswing  for  all  methods. 

Another  survey  finding  of  interest  to 
CIOs:  Only  19  percent  of  the  execu¬ 
tives  agreed  with  the  statement  that 
“We  have  cut  back  too  far  on  IT  spend¬ 
ing.”  Fully  57  percent  disagreed.  Is 
that  a  call  for  CIOs  to  align  all  IT 
projects  with  business  needs,  or  just 
to  rename  them  as  management  tools 
and  techniques?  -Edward  Prewitt 
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ILLUSTRATION  BY  HARRY  CAMPBELL 


Performance: 

Superior  power  and  reliability. 


Thirty  years  ago  Ethernet  was  just  an  idea.  Today 
it's  the  technology  that  drives  your  business. 

For  nearly  three  decades,  3Com®  has  delivered  the 
high-performance  Ethernet  switching  that  keeps 
networks  running  reliably,  and  provides  the  tools  for 
people  to  work  productively  and  businesses  to  compete 
successfully.  For  proven  performance  and  value,  choose 
3Com  10/100  switches. 

Enterprise-class  features  and  flexibility 

Feature-rich  3Com  SuperStack®  3  Switch  4400  family 
switches  are  ideal  for  high-performance  environments 
running  IP  telephony,  Power  over  Ethernet,  security,  or 
where  a  highly  optimized,  resilient  network  is  needed. 


SuperStack  3®  Switch  4400  Family 


Plus ,  get  $60  CASH  BACK  for  every  Switch  4400  you  buy 
'  ■“  $50  CASH  BACK  for  every  Switch  4200  you  buy 

$150  CASH  BACK  BONUS  when  you  buy  any  3 


HURRY— OFFER  ENDS 
AUGUST  31,  2003! 


SuperStack  3  Switch  4200  Family 


Small  office  affordability  and  convenience 

Economical  3Com  SuperStack  3  Switch  4200  family 
switches  offer  Layer  2  switching  that's  easy  to  install, 
operate  and  afford.  Built-in  stacking,  wirespeed 
performance,  ease-of-use  features  and  standards- 
based  operations  help  ensure  that  you'll  be  up  and 
running  in  no  time. 


Get  CASH  BACK  on  every  3Com  SuperStack  3 
Switch  4400  and  Switch  4200  you  buy...  plus  the 
chance  to  win  a  classic  1973  Chevrolet  Corvette!* 
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*  Restrictions:  Rebate  program  is  open  to  end  user  companies  in  the  United  States  (excluding  Puerto  Rico)  and  Canada.  It  cannot  be  combined  with  any  other  3Com  discount  program  or  promotion.  For  complete 
rules  visit  www.3com.com/73corvette/promo15.  Ends  8/31/03.  Sweepstakes  is  open  to  employees  of  end  user  companies  in  the  United  States  (excluding  Puerto  Rico)  and  Canada  (excluding  Quebec).  No  Purchase 
Necessary.  Purchase  Will  Not  Increase  Chances  Of  Winning.  Prize  valued  at  $20,000  (USD).  Odds  of  winning  depend  on  number  of  entries.  Subject  to  Official  Rules.  For  rules  and  entry  details  visit 
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Chevrolet  and  Corvette  are  trademarks  of  GM  Corp.  Chevrolet  is  not  a  sponsor  and  does  not  endorse  3Com  products.  Corvette  model  depicted  may  not  completely  or  accurately  represent  the  sweepstakes  prize. 

Copyright  ©  2003  3Com  Corporation.  All  rights  reserved.  3Com,  the  3Com  logo,  and  SuperStack  are  registered  trademarks  and  Possible  made  practical  is  a  trademark  of  3Com  Corporation.  All  other  company  and 
product  names  may  be  trademarks  of  their  respective  companies. 


cal  services.  “A  lot  of 
[business]  people  were 
nervous  about  hand¬ 
ing  stuff  over  to  the  IT 
department  because 
they  perceived  us  as 
having  an  attitude.”  Once  the  post-layoff 
staff  of  64  saw  the  problems  in  black  and 
white,  they  were  more  willing  to  change 
their  conduct,  Hofmann  says. 

Today,  Mapics’  reorganization  is  com¬ 
plete.  Even  more  workers  are  going  vir¬ 
tual.  Offshore  outsourcing  is  in  full  swing. 
And  after  two  years  of  losses  exceeding 
$20  million,  the  company  returned  to  the 
black  in  2002,  with  profits  of  $14  mil¬ 
lion  on  $128  million  in  revenue. 

The  IT  department  doesn’t  get  that 
much  attention  from  its  users  now — which 


Hot 

Seat 


“People  with  learning 
disabilities  are 
extremely  bright,  but 
one  of  their  primary 
learning  channels  is 
not  functioning.  In  IT, 
you  have  individuals 
who  excel  in  certain 
areas  but  not  in  others. 
And  you  may  have  to 
capture  their  attention 
in  different  ways.” 

-Mapics  CIO  and  Chief  People 
Officer  Sandra  Hofmann 


is  a  good  thing.  “It’s  like  the  electric  com¬ 
pany.  When  you  flip  the  switch,  you  expea 
the  lights  to  go  on,  and  you  hardly  think 
about  it.  However,  if  the  lights  don’t  go  on, 
you’re  not  too  happy,”  Cook  says.  “IT 
service  is  the  same.  A  year  ago,  it  didn’t 
always  work.  Today  it  works.”  BE 


Could  your  organization  cope  with  changes  as 
drastic  as  those  at  Mapics?  E-mail  your  thoughts 
to  hotseat@cio.com.  Senior  Writer  Stephanie 
Overby  (soverby@cio.com)  covers  outsourcing. 


Leadership  Agenda  by  susan  h.cramm 

A  Cry  for  Full-Cycle 
Governance 

It’s  the  only  way  to  ensure  project  success 

MIT’s  Peter  Weill  says  that  “an  effective  IT  governance 
structure  is  the  single  most  important  predictor  of  getting 
value  from  IT”  (from  his  paper  "Don't  Just  Lead,  Govern: 
Implementing  Effective  IT  Governance,”  coauthored  with 
Richard  Woodham).  If  that’s  true,  how  do  we  explain  the 
fact  that  many  organizations  have  not  set  up  governance 
in  a  way  that  promotes  value? 

That  question  was  recently  posed  to  me  by  one  of  my  clients.  Even  though 
she  is  responsible  for  her  company's  current  governance  structure,  she  sees  it 
for  what  it  really  is:  nothing  more  than  a  well-run  project  approval  process,  with 
ROI  calculations,  business  sponsor  testimonials  and  meetings  attended  by  all 
the  usual  suspects.  At  no  time  has  the  governing  body  revisited  an  approved 
project  in  light  of  new  information  (also  known  as  change  requests),  termi¬ 
nated  a  project  or  assessed  the  company's  track  record  for  value  realization. 
Sound  familiar? 

Let's  be  honest.  At  many  companies,  governance  should  be  called  "govern- 
once."  Although  there  is  broad  agreement  about  what  governance  should  be— 
“the  decision  rights  and  accountability  framework  to  encourage  the  desirable 
behavior  in  the  use  of  IT,”  as  Weill  puts  it— in  reality  what  passes  for  gover¬ 
nance  is  often  a  one-dimensional,  checklist-based  and  attendance-based 
effort  focused  solely  on  project  prioritization  and  approval. 

In  The  Information  Paradox,  John  Thorp  writes  about  full-cycle  governance. 
CIOs  must  ask  themselves  four  “ares"  to  reach  this  ideal  state: 

1.  Are  we  doing  the  right  things? 

2.  Are  we  doing  them  the  right  way? 

3.  Are  we  getting  them  done  well? 

4.  Are  we  getting  the  benefits? 

If  you  think  about  these  four  questions,  you  can  easily  see  that  many  compa¬ 
nies  focus  their  efforts  on  the  first  but  never  address  the  other  three  concerns. 

Since  most  competent  IT  executives  understand  what  governance  should 
be,  it  is  safe  to  assume  that  they  have  good  reasons  for  not  pushing  harder  for 
full-cycle  governance.  In  my  view,  they  don’t  believe  the  effort  is  justified. 

Without  question,  it’s  hard  work  implementing  full-cycle  governance.  Many 
organizations  have  immature  investment  disciplines  typified  by  a  “if  we  build 
it,  the  value  will  come”  approach.  They  will  not  devote  the  effort  necessary  to 
establish  measurement  systems  that  will  sustain  a  focus  on  projects  for  years 
after  they  have  been  theoretically  implemented.  In  addition,  since  the  major¬ 
ity  of  CEOs  believes  that  CIOs  should  be  held  accountable  for  realizing  value 
from  IT  investments,  it  takes  a  lot  of  rewiring  to  get  the  accountability  shifted 
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to  where  it  needs  to  be:  the  business 
leaders  who  own  the  three  P’s  of  value 
realization— people,  processes  and 
P&L.  Finally,  a  lot  of  IT  types  don’t 
believe  that  value  targeting  and 
monitoring  is  practical  (for  example, 
proponents  of  the  “ROI  is  dead" 
position). 

What’s  more,  from  a  payoff  perspec¬ 
tive,  the  link  between  full-cycle  gover¬ 
nance  and  CIO  success  is  hard  to  see. 
CIOs  understand  that  as  long  as  they 
ensure  that  the  right  projects  are 
selected  and  successfully  delivered, 
they  will  not  only  survive  but  thrive. 
The  effort  required  to  achieve  full- 
cycle  governance  is  just  too  much  for 
most  CIOs.  As  a  result,  they  limit  their 
project  management  to  govern-once. 
These  CIOs  believe  they  can  make 
most  any  project  succeed  as  long  as 
they  have  enough  business  sponsors, 
subject  matter  expertise  and  money. 

That  belief  is  wrong.  Business 
sponsorship  is  a  weak  substitute  for 
leadership.  Many  CIOs  don't  under¬ 
stand  that  full-cycle  governance  is  an 
industrial-strength  method  of  improv¬ 
ing  the  success  of  IT  projects.  By 
driving  project  success,  IT  value 
becomes  more  than  a  projection— it 
becomes  reality. 

It  does  so  by  transforming  a  busi¬ 
ness  project  sponsor  into  a  business 
project  leader.  Using  a  parenting 
analogy,  full-cycle  governance  forces 
business  leaders  to  raise  the  project  as 
one  of  their  own  rather  than  send  it  to 
the  IT  boarding  school.  This  increased 
accountability  motivates  business 
leaders  to  assign  their  top  talent, 
establish  baseline  measurement 
systems,  manage  risks  and  manage 
project  scope,  and  see  changes 
through.  Full-cycle  governance 
induces  business  leaders  to  cascade 
project  accountability  throughout  their 
organizations  rather  than  leaving 
accountability  to  the  CIOs. 


It’s  time  for  CIOs  to  reassess  full- 
cycle  governance.  The  govern-once 
mechanisms  in  place  at  most  compa¬ 
nies  are  only  a  first  step  in  realizing 
value  from  IT-enabled  business 
investments. 


Reader  Q&A 

Susan  H.  Cramm  answers 
questions  on  “A  Cry  for 
Full-Cycle  Governance ” 

Q:  In  your  example,  the  project  review 
process  is  typically  performed  once. 

My  experience  is  that  changes  in 
excess  of  a  certain  monetary  or  value 
threshold  require  that  a  project  be 
reevaluated.  The  review  process  is  both 
time-consuming  and  expensive. 

A:  You  bring  up  an  important  point: 
Successful  governance  mechanisms 
depend  on  ensuringthat  the  initial  and 
subsequent  project  evaluations  and 
decisions  are  performed  quickly. 
Review  processes  can  be  expedited  if 
the  executive  investment  management 
board:  1.  understands  how  much  it  can 
spend  and  what  return  the  project 
should  generate:  2.  is  able  to  convene 
virtually  to  make  critical  decisions 
quickly:  3.  is  supported  by  an  inde¬ 
pendent  group  of  value  analysts  who 
ensure  quality  submissions:  and  4. 
delegates  responsibility  for  decisions 
that  are  below  certain  risk  thresholds. 

Q:  We  have  taken  the  first  step  in 
implementing  governance  councils 
with  relative  success.  However,  we 
struggle  with  keeping  project  updates 
focused  on  pertinent  issues. 

A:  Great  councils  rely  on  good  staff 
work.  Good  staff— in  the  value  man¬ 
agement  world— will  focus  the  council 
on  the  decisions  it  needs  to  make  by 
presenting  the  relevant  information  in 
a  succinct  format.  The  value  manage¬ 
ment  analysts  should  be  independent 


of  the  IT  organization— most  likely 
staffed  from  the  finance  function. 

Q:  What  is  the  best  way  to  codify  the 
life  cycle  of  corporate  governance? 

A:  The  first  step  is  getting  the  CEO  and 
COO  to  make  it  clear  that  business 
executives  are  accountable  for  value 
realization.  The  second  step  is  show¬ 
ing  that  value  monitoring  can  be  made 
practical  and  consistent  with  the 
company  culture.  Partner  with  the  CFO 
and  find  a  receptive  general  manager 
and  a  project  that  can  be  used  as  a  test 
case.  After  a  few  iterations  of  this 
process,  the  company  commitment 
will  have  solidified,  and  the  require¬ 
ments  for  a  codifying  tool  will  be 
understood. 

Q:  How  can  we  get  answers  to  John 
Thorp’s  questions?  For  example,  how  do 
we  benchmark  IT  change  control?  We 
have  already  checked  ITeL  [the  IEEE 
Information  Technology  Library],  some 
consulting  companies  and  our  peer 
organizations. 

A:  Don’t  start  from  scratch,  but  do 
remember  to  start  your  education 
process  at  the  top  of  your  organization. 
Don’t  benchmark  with  peer  organiza¬ 
tions;  benchmark  with  companies  that 
are  more  mature  in  their  IT  practices. 
Look  for  organizations  in  industries  or 
segments  that  have  a  higher  level  of 
information  intensity.  For  example,  if 
you  are  in  retail,  visit  distribution 
companies.  If  you  are  in  brick-and- 
mortar  manufacturing,  visit  online 
manufacturers.  If  you  are  in  health 
care,  visit  insurance  companies.  If  you 
are  in  insurance,  visit  banking. 


To  see  more  reader  questions  and  answers  from 
Susan  H.  Cramm,  go  to  www.cio.com/leadership 
/agenda. html.  Cramm  is  president  of  Val- 
uedance,  an  executive  coaching  firm  based  in 
San  Clemente,  Calif.  Her  e-mail  address  is 
scramm@cox.net. 
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Patching  Things  Up 


The  latest  patch  management  tools 
reliability  by  bob  violino 

UNTIL  RECENTLY,  patch  management  was  some¬ 
thing  most  technology  managers  didn’t  think 
much  about.  Security  holes  and  bugs  appeared; 
vendors  released  patches  to  repair  them — and 
that  was  that.  But  software  companies  now 
release  thousands  of  patches  every  year,  and 


can  help  reduce  costs  and  increase 

CIOs  are  running  into  potentially  costly  prob¬ 
lems  because  they  don’t  have  an  efficient,  auto¬ 
mated  way  to  manage  and  deploy  these  fixes. 

To  combat  the  problem,  many  companies  are 
coming  to  rely  on  products  that  automate  the 
process.  The  general  consensus  among  IT  man- 


Patch  management. ..Long-range  monitoring. ..High-end  storage 
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agers  who  use  these  patch  management 
tools  is  that  they  are  well  worth  the  invest¬ 
ment — saving  time,  labor  and  money.  But 
be  warned:  Patch  management  alone  won’t 
provide  a  complete  solution.  Organizations 
need  to  combine  automation  with  an  effort 
to  rein  in  the  out-of-control  computing 
environments  that  helped  make  patch 
deployment  so  complex  in  the  first  place, 
say  IT  managers  and  analysts. 

Patch  Wars 

Patch  deployments  are  often  major 
endeavors,  requiring  companies  to  devote 
thousands  of  man-hours  to  manual  fixes. 
Deploy  the  wrong  patches,  or  fail  to  patch 
the  right  machines,  and  the  resulting  vul¬ 
nerabilities  can  become  major  problems. 
(The  SQL  Slammer  worm,  for  instance, 
took  advantage  of  a  flaw  in  Microsoft’s 
software  that  already  had  a  patch.)  A  sur¬ 
vey  last  year  by  Aberdeen  Group  showed 
that  companies  and  government  agencies 
worldwide  are  spending  in  excess  of  $2  bil¬ 
lion  annually  to  deal  with  patches.  And 


Patches  are  generally  issued  “in  a  way 
that’s  convenient  for  the  supplier  but  not 
necessarily  for  the  user,”  Hemmendinger 
adds.  “Supplier  assessments  as  to  whether 
patches  are  critical  are  judgments  rendered 
in  a  vacuum;  vendors  don’t  know  what 
the  customer  is  doing  with  their  product.” 

Automation  Opportunity 

Some  analysts  say  companies  shouldn’t 
even  consider  applying  patches  manually. 
“It’s  impossible.  If  you  think  about  a  com¬ 
pany  with  thousands  of  desktops  and  hun¬ 
dreds  of  servers,  manual  processes  don’t 
scale,”  says  Gartner  Research  Director 
Mark  Nicolett.  “For  each  system,  you  have 
to  look  at  what  software  is  installed  and 
understand  which  patches  apply  to  that 
machine.  It  takes  lots  of  analysis  to  figure 
out  which  one  goes  on  which  machine.” 

Patch  management  tools  look  for  and 
analyze  new  patches,  scan  devices  on  net¬ 
works  to  find  vulnerabilities,  and  deploy 
the  correct  patches.  Some  products  also 
test  the  patches  to  verify  that  they  work. 


Be  warned:  Patch  management  alone 
won’t  provide  a  complete  solution. 


Digex,  a  provider  of  managed  Web  and 
application  hosting  services,  calculates  the 
annual  cost  of  manually  managing  patch 
deployment  to  be  about  $14,400  per  server. 

“[That  cost  is]  extraordinary,  and  that’s 
just  at  the  Microsoft  level;  other  vendors 
have  vulnerabilities  as  well,”  says  Bobby 
Patrick,  vice  president  of  strategy  at  Digex. 
“It’s  war  out  there  to  manage  patches.” 
And  the  situation  is  getting  worse  as  com¬ 
panies  get  inundated  with  patch  releases. 
(CERT,  for  example,  reported  4,129  secu¬ 
rity  vulnerabilities  in  2002,  nearly  twice 
as  many  as  in  the  previous  year.) 

“It’s  like  drinking  from  a  fire  hose,” 
says  Eric  Hemmendinger,  a  research  direc¬ 
tor  at  Aberdeen.  Even  when  a  company 
devotes  people  to  patch  deployments,  “a 
lot  of  time  has  to  be  spent  on  this  if  you 
want  to  be  diligent  about  it,”  he  notes. 


But  automated  systems  aren’t  a  cure-all. 
Truck  manufacturer  Paccar  has  been  using 
several  patch  management  tools  “with 
varying  degrees  of  success,”  says  Vice  Pres¬ 
ident  and  CIO  Patrick  Flynn. 

Paccar  has  used  products  from  McAfee 
Security,  Microsoft  and  On  Technology  to 
automatically  deploy  patches  to  PCs  and 
servers,  Flynn  says,  cutting  the  time  it 
takes  for  deployments  and  improving  their 
accuracy.  “We  don’t  have  to  send  an  army 
of  people  out  there  [to  deploy  patches]. 
From  a  labor  perspective,  the  return  on 
investment  has  to  be  pushing  100  per¬ 
cent,”  he  says.  “But  there’s  still  a  long  way 
to  go  before  we  get  to  where  we  need  to 
be”  because  the  tools  don’t  ensure  that  all 
of  the  company’s  more  than  12,000  PCs 
and  servers  are  getting  the  correct  patches 
when  they  need  them. 


Patch  Tools 

Anticipated  benefits  Reduced 
downtime  because  of  software  fail¬ 
ures;  mitigated  risk  of  attack  from 
hackers;  and  lower  costs  than 
manually  applying  patches. 

Hurdle  No  one-size-fits-all  patch 
management  tool  available  yet, 
which  requires  customers  to  pur¬ 
chase  more  than  one  product  to 
cover  all  systems  and  software. 

Cost  Varies  by  application  and 
environment;  $8.50  to  $100  per 
workstation  per  year  and  $20  to 
$2,500  per  server  per  year, 
depending  on  product  and 
configuration. 

Vendors 

BigFix  www.bigfix.com 
BigFix  Patch  Manager  3.0 

Configuresoft 

www.  configuresoft.  com 
ECM  Security  Update  Manager 

Ecora  www.ecora.com 
Ecora  Patch  Manager 

LANDesk  Group 

www.iandesk.com 
LANDesk  Management  Suite 

Kintana  www.kintana.com 
Kintana  Change  Manager 

Microsoft  www.microsoft.com 
Software  Update  Services 

Novadigm 

www.  novadigm.  com 
Radia  Patch  Manager 

On  Technology 

www.on.com 
On  iCommand 

PatchLink  www.patchlink.com 
PatchLink  Update 

Shavlik  Technologies 

www.shavlik.com 

HFNetChkPro 

St.  Bernard  Software 

www.stbernard.com 

UpdateExpert 
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“If  your  success  rate  is  90  percent, 
you  still  have  1,000  devices  to  find  and 
update,”  Flynn  says.  “There  isn’t  really  an 
integrated  one-size-fits-all  tool  for  patch 
management.  If  you’re  a  global  IT  organ¬ 
ization,  you  need  a  variety  of  tools  to 
deploy  patches  for  security,  operating  sys¬ 
tems,  browsers,  applications.  And  patches 
have  to  be  applied  to  servers,  desktops 
and  PDAs.  How  do  we  manage  all  that 
software?  It’s  one  of  the  biggest  problems 
facing  our  industry.” 


The  management  tools  have  been  fairly 
easy  to  set  up,  Flynn  says,  but  there  can  be 
some  complexity  when  integrating  patch 
tools  with  existing  software.  He  says  com¬ 
panies  should  have  someone  dedicated  to 
overseeing  patch  management  software  to 
ensure  it’s  being  used  most  efficiently. 

A  Hard  Patch 

Paccar’s  experience  is  mirrored  by  others. 
After  the  Slammer  attack  illustrated  com¬ 
panies’  vulnerabilities,  RBC  Centura  Banks 
issued  a  corporate  mandate  to  bring  all  its 
production  servers  up  to  date  on  required 
patches.  “We  checked  into  doing  it  manu¬ 
ally  and  knew  we  had  a  sizable  task  in 
front  of  us,”  says  James  Williams,  man¬ 
ager  of  information  delivery. 

Managers  estimated  it  would  take  more 
than  12,000  man-hours  to  complete  the 
task,  including  deploying  and  testing 
patches  on  more  than  220  servers.  RBC 
opted  instead  to  use  Ecora’s  PatchMeister 
to  deploy  patches,  and  the  process  took 
about  2,000  hours  in  just  over  a  month. 
Williams  says  there  was  still  manual  work 
involved,  when  technicians  had  to  tweak 
some  of  the  patch  deployments  for  par¬ 
ticular  servers.  But  the  automation  soft¬ 
ware  did  provide  time  and  labor  savings, 
Williams  says.  “It  helped  us  to  quickly 
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identify  the  status  of  the  servers  and  told 
us  which  patches  we  needed  to  apply  in 
our  NT  and  Windows  2000  environ¬ 
ment.”  The  bank  uses  the  software  to 
evaluate  and  deploy  anywhere  from  two 
to  15  patches  per  month. 

RKA  Petroleum  faced  the  problem  of 
the  faulty  patch.  The  petroleum  products 
wholesaler  had  been  struggling  for  months 
to  keep  current  with  the  constant  release 
of  patches  from  Microsoft  and  other  ven¬ 
dors.  Things  came  to  a  head  earlier  this 


year  when  a  critical  server  crashed  because 
it  was  using  the  wrong  software  patch;  IT 
staffers  spent  15  hours  on  the  phone  with 
Microsoft  reps  trying  to  figure  out  which 
patch  to  deploy.  Ultimately  they  ended  up 
rebuilding  the  server. 

“The  problem  was  Microsoft  assigned 
a  patch  that  was  not  needed  for  the 
machine.  There  wasn’t  enough  disk  space 
for  the  patch,  and  it  started  deleting  files. 
Services  started  to  fail,  and  people  couldn’t 
log  on  to  our  network,”  says  IS  Manager 
Jason  Hittleman. 

Soon  after  the  incident,  RKA  bought  a 
patch  management  product  called  Update 
from  PatchLink,  Hittleman  says.  RKA 
now  uses  the  software  to  automatically 
deploy  patches  to  its  PCs  and  servers  after 
approval  by  a  human  administrator. 

The  problem  could  have  been  avoided 
if  the  software  had  been  in  place  to  deploy 
the  correct  patch,  Hittleman  says.  “It 
knows  exactly  what’s  on  each  machine,” 
so  there’s  less  chance  for  errors  in  deploy¬ 
ment,  he  says.  “Before  this  problem,  we 
had  put  all  our  trust  in  Microsoft.  When¬ 
ever  they  recommended  a  patch,  we 
wouldn’t  think  twice  about  it.  This 
opened  our  eyes  to  the  issue.”  He  says  the 
sub-$2,000  software  has  already  paid  for 
itself  in  reduced  labor  costs. 
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Vendors  to  the  Rescue? 

Some  companies  are  trying  to  get  software 
vendors  to  help  ease  patch  management. 
Qualcomm,  for  instance,  is  using  five  dif¬ 
ferent  patch  management  vendors  for  var¬ 
ious  platforms,  including  Kintana  (which 
was  purchased  by  Mercury  Interactive)  for 
patches  on  Oracle  applications. 

“We  are  working  with  Oracle  to  [try 
to]  simplify  the  patching  process,”  says 
Tom  Fisher,  vice  president  of  IT  for  Qual¬ 
comm’s  CDMA  technologies  division. 
“There  are  a  lot  of  patches  required  in 
their  product  set  because  of  the  [sheer  vol¬ 
ume]  of  applications.  We’re  pushing  Ora¬ 
cle  to  simplify  the  patching  process  and 
either  help  us  provide  a  better  patch  solu¬ 
tion  or  adopt  [technology  from  a  vendor] 
like  Kintana  as  a  standard.” 

Fisher  considers  logs  that  track  how 
well  patches  are  distributed  to  be  a  critical 
feature.  “Give  me  a  log  that  tells  me  [the 
status  of  a  patch  distribution],  so  I  know 
that  it  only  happened  on  this  machine, 
and  I  don’t  have  to  worry  about  the  18 
other  machines  I  pushed  to  today.  Logs 
are  critical.  I  want  to  know  how  many 
[patches]  failed.  Why  did  they  fail?” 

Fisher  says  it’s  difficult  to  know  which 
of  the  many  patch  management  prod¬ 
ucts  are  best.  “We  have  Solaris,  HP-UX  and 
Linux,  and  we’re  trying  to  figure  out  a 
solution  that  will  cover  all  three,”  he  says. 
“Typically  we’ve  found  we’d  have  to  write 
[such  a  solution].  I’d  love  to  be  able  to  use 
one  tool,  but  I  know  that  applications  are 
different  from  firmware,  which  is  different 
from  operating  systems.” 

Even  with  automated  patch  manage¬ 
ment,  analysts  say,  the  process  can  still  be 
complex.  “If  a  company  has  an  unstruc¬ 
tured  environment  with  a  large  combina¬ 
tion  of  software  products  on  PCs  and 
servers,  it’s  not  in  a  good  position — no 


Peer  Resources 


The  August  issue  of  CSO  Magazine  features 
a  definitive  account  of  the  inherently  flawed 
world  of  SOFTWARE  PATCHING  and  how  it's 
breaking  down.  Read  "Can’t  Patch  This"  at 

www.csoonline.com 


Digex  calculates  the  annual  cost  of  manually 
managing  patch  deployment  to  be  about 
$14,400  per  server. 
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matter  what  patch  management  tool  it’s 
using,”  says  Gartner’s  Nicolett. 

“Patch  management  software  is  help¬ 
ful  in  that  you  at  least  have  a  vehicle  for 
delivering  a  high  volume  of  patches  auto¬ 
matically.  But  if  you  have  five  configura¬ 
tions  of  Windows  and  500  flavors  of 
production  systems,  it’s  still  very  difficult 
to  deploy  patches,”  says  Laura  Koetzle,  a 
senior  analyst  at  Forrester  Research. 
“Having  too  many  configurations  of 
Windows  is  a  huge  problem.” 

Koetzle  suggests  enterprises  select  three 
or  four  standard  configurations — for 
example,  a  Web  server,  an  application 
server  and  a  back  office — and  standardize 
on  those.  “This  ensures  that  eventually  you 
will  have  a  standard  pool  of  Windows 
configurations  that  you  can  more  easily 
test  patches  against,”  she  says. 

Paccar’s  Flynn  agrees  that  computing 
environments  are  getting  too  complex. 
“For  the  last  several  years,  we’ve  worked 
to  get  control  of  our  computing  envi¬ 
ronment,”  he  says.  “The  more  you  add 
things,  the  more  difficult  it  becomes.” 
For  that  reason,  Paccar  has  begun  to 
restrict  company  PC  specifications  and 
software  packages,  and  restricts  who  can 
modify  settings. 

Meanwhile,  software  vendors  (see  “Patch 
Tools,”  Page  80)  are  lining  up  to  provide 
patch  management  tools.  Microsoft  is 
attempting  to  improve  its  own  patch  solu¬ 
tions.  In  June,  the  company  launched  a 
redesigned  patch  management  tool  and 
announced  it  would  make  continued 
improvements  to  its  system  for  issuing 
security  patches  for  its  products.  Microsoft 
later  this  year  will  consolidate  the  ways  it 
distributes  patches  to  customers,  to  sim¬ 
plify  the  process. 

Will  such  efforts  decrease  the  need  for 
patch  management  tools?  Not  likely.  “The 
tools  vendors  will  always  be  able  to  pro¬ 
vide  some  additional  value  on  top  of  what 
Microsoft  is  doing,”  says  Koetzle.  ■ 


Bob  Violino  is  a  freelance  writer  based  in  New 
York  City. 


UNPLUGGED 

Wireless  monitoring 

Remotely  Possible 

CHECKING  THE  VITAL  STATISTICS  of  an  oil  well  calmly  pumping  away  in  the  middle  of 
a  dusty  nowhere  is  a  time-consuming,  tedious,  expensive— and  completely  necessary- 
job.  High-end  wells  can  produce  hundreds  of  gallons  of  oil  per  day,  and  failing  equipment 
could  result  in  significant  bottom-line  damage  if  the  flaws  aren’t  promptly  detected. 

To  fulfill  the  oil  companies’  desire  to  keep  an  efficient  eye  on  the  daily  lives  of  their 
equipment,  Luna  iMonitoring  ( www.lunaimonitoring.com )  is  developing  technology 
intended  to  let  customers  remotely  track  critical  measurements,  such  as  pressure,  tank 
levels  and  natural  gas  flows.  The  iMonitoring  systems  combine  multiple  components— 
including  a  solar  cell,  battery  pack,  computer  processor,  data  radio  and  sensors— into 
compact,  relatively  low-cost  packages  that  can  be  quickly  and  easily  attached  to  pump 
equipment.  These  packages  then  transmit  via  a  proprietary  radio  protocol  to  a  concen¬ 
tration  and  communications  unit  that  uploads  the  data  via  satellite  to  the  oil  company’s 
waiting  computers  for  analysis. 

The  goal,  says  CEO  Kenneth  Ferris,  is  to  “drive  down  the  cost  factor”  of  such  monitor¬ 
ing  equipment  by  a  factor  of  four  or  five,  allowing  pump  operators  to  make  an  economi¬ 
cally  feasible  argument  for  putting  the  gear  on  less  productive  wells.  Typical  solutions 
available  today  tend  to  cost  between  $10,000  and  $15,000,  Ferris  says.  The  iMonitoring 
tools  currently  being  beta  tested  will  cost  in  the  $3,000  range,  with  a  second  generation 
available  in  two  years  that  would  cost  about  half  that. 

Ferris  sees  the  technology  moving  beyond  the  energy  industry.  He  notes  that,  if  available 
cheaply  enough,  the  tools  could  appeal  to  the  wastewater  and  agriculture  industries,  as 
well  as  for  general  industrial  automation.  For  instance,  Luna  has  developed  a  vibration  sen¬ 
sor  that  can  detect  when  bearings  in  pumps,  compressors  or  turbines  start  to  fail. 

Luna  iMonitoring  is  still  in  the  R&D  stage,  according  to  Ferris.  But  he  expects  products 
to  ship  in  the  fourth  quarter  of  this  year. 

-Christopher  Lindquist 
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COMPANY  TO  WATCH 
BlueArc 

BlueArc  Branches  Out 

High-performance  storage  company  seeks  some  room  on  the 
lower  end  by  meridith  levinson 


IN  1998,  Geoff  Barrall  was  in  London 
designing  data  centers  as  a  consultant  for 
customers  including  General  Motors  and 
BMW  when  he  discovered  the  idea  for 
his  next  business.  One  of  Barrall’s  cus¬ 
tomers  was  experiencing  bottlenecks  on 
its  servers,  which  couldn’t  keep  up  with 
the  speed  of  the  company’s  new  gigabit 
Ethernet  network.  Barrall  set  out  to  find  a 
server  that  could  keep  pace.  When  he  con¬ 
cluded  his  search  empty-handed,  he  came 
up  with  the  idea  for  BlueArc,  the  com¬ 
pany  for  which  he  is  now  executive  vice 
president  and  CTO. 

Today,  BlueArc  makes  high-end  network 
attached  servers  (NAS)  that  are  known  for 
their  performance  and  scalability.  While  the 
venture-funded  company  may  have  just 
1 .4  percent  of  the  total  NAS  market,  Gart¬ 
ner  ranks  it  number  three  behind  behe¬ 
moths  EMC  and  Network  Appliance  in 
the  NAS  market’s  high-end  segment.  “The 
market  we  classify  as  NAS  is  fast  growing 
with  a  16.7  percent  [compound  annual 
growth  rate],”  says  Gartner  analyst  Roger 
Cox.  “That’s  the  highest  growth  rate  in 
the  storage  market.  By  2007,  it  will  be 
$3  billion  in  size.” 

Turning  Software  into 
Hardware 

BlueArc  has  so  far  been  able  to  compete 
with  the  big  boys  mainly  by  virtue  of 
its  unique,  hardware-based  architecture. 
Instead  of  building  a  server  that  relies  on 
specialized  software  for  managing  its  load, 
BlueArc  bases  its  servers  on  custom- 
designed  integrated  circuits  dedicated  to 
simultaneously  performing  typical  server 
tasks  such  as  networking,  file  system  and 


BlueArc 


Headquarters  San  Jose,  Calif. 
Founded  1998 
Employees  200 

Products  SiliconServer  multitiered 
storage 

Reason  to  watch  Its  unique 
hardware-based  architecture  makes 
file  servers  run  faster  and  more  effi¬ 
ciently.  New  product  lets  companies 
lower  their  costs  by  matching  different 
kinds  of  storage  with  different  applica¬ 
tions,  all  in  the  same  storage  system. 
Hurdles  to  clear  Lack  of  market 
presence.  Strong  competitors. 

Web  link  www.bluearc.com 

server  management.  Barrall  says  the  migra¬ 
tion  of  software  into  hardware  and  the 
parallel  processing  make  the  server  run 
faster  and  more  efficiently.  Indeed,  Vijay 
Agarwala,  director  of  GeARS,  Penn  State 
University’s  high-performance  computing 
center,  replaced  three  of  his  existing  file 
servers  with  a  single  Si7500  file  server 
from  BlueArc. 

In  an  effort  to  further  differentiate  itself 
from  competitors  and  to  respond  to  cus¬ 
tomers’  price  fixation,  the  company 
released  a  new  product  last  April  called 
the  BlueArc  SiliconServer.  It  lets  compa¬ 
nies  deploy  different  kinds  of  storage — 
such  as  high-speed,  high-performance  fibre 
channel  and  lower  speed  ATA — in  the 
same  NAS  system.  Using  this  multitiered 
approach  to  storage,  customers  can  decide 
which  applications  should  run  on  higher 
performance  disks  and  which  can  run  on 
lower  performance — and  lower  cost — 
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hardware.  “In  a  competing  system,  every¬ 
thing  has  to  be  stored  either  all  in  fibre  or 
all  ATA,”  says  Gartner’s  Cox.  He  adds 
that  mixing  different  types  of  storage  on 
the  same  platform  allows  the  CIO  to  con¬ 
figure  a  storage  system  that  gives  his  com¬ 
pany  the  best  price-performance  ratio. 

“  [BlueArc ’s  multitiered  approach]  is 
going  to  allow  companies  to  reduce  their 
initial  capital  outlay  for  robust  enterprise 
quality  storage,  and  it’s  going  to  allow  them 
to  reduce  their  total  cost  of  ownership  over 
time,”  says  Cox.  And  BlueArc’s  products 
are  so  scalable  (they  can  deploy  with  as 
much  as  200  terabytes  of  storage  compared 
with  competitors’  2  to  6  terabytes),  com¬ 
panies  don’t  need  to  deploy  as  many  units. 
“The  fewer  the  number  of  units,  the  less 
costly  it  is  to  manage,”  adds  Cox. 

An  Uphill  Battle 

Mark  Chandler,  director  of  information  sys¬ 
tems  at  drug  discovery  company  Neo- 
Genesis  Pharmaceuticals,  concurs  with  Cox. 
“Backing  up  one  large  disk  as  opposed  to 
many  servers  makes  life  so  much  simpler,” 
he  says.  Chandler  also  likes  BlueArc’s  com¬ 
petitive  prices,  which  made  him  decide  to 
stop  purchasing  from  EMC.  Barrall  says 
BlueArc’s  products  start  at  $40,000  and 
average  between  $100,000  and  $200,000. 
Chandler  also  selected  BlueArc  over  the 
competition  because  its  servers  are  compat¬ 
ible  with  the  two  platforms  his  company 
runs,  Windows  and  Linux. 

In  spite  of  BlueArc’s  advantages  (strong 
engineering  and  R&D,  solid  technology, 
good  customer  service  and  happy  cus¬ 
tomers),  the  company  still  faces  an  uphill 
battle  for  survival.  Cox  notes  that  to  break 
even,  BlueArc  is  going  to  have  to  double 
its  2002  revenue  of  $19  million.  And  to 
do  that,  he  says,  the  company  needs  to 
increase  its  visibility  and  credibility  by 
partnering  with  resellers  that  focus  on  ver¬ 
tical  markets,  which  would  open  another 
distribution  channel.  EEI 


Senior  Writer  Meridith  Levinson  can  be  reached  at 
mlevinson@cio.  com . 
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SYMPOSIUM  AND  AWARDS 


CEREMONY 


Sunday 


8:00  AM-1:30  PM 

Golf  Tournament 

2:00  PM-7:30  PM 

Registration 

4:15  PM-5:30  PM 

CIO  Executive  Mindshare 
Meetings 

Small  working  groups  explore  the 
leadership  challenges  and  best 
practices  of  specific,  critical 
IT/business  topics. 

1  Managing  the  risks  of 
outsourcing— including  offshore 

2  IT  cost  control  &  flexibility 

3  Leveraging  IT  employees:  bring¬ 
ing  their  full  potential— 

and  hanging  on  to  them 

4  The  CSO  in  you:  how  to  be  your 
own  security  watchdog 

5  Long-term  partnerships:  negoti¬ 
ating  strong,  mutually  benefi¬ 
cial  vendor  deals 

6  Dealing  with  consolidation  in 
the  tech  industry 

7  Ensuring  data  privacy  in  an 
access-hungry  environment 

5:30  PM-7:30  PM 

Cafe  100:  Welcome 
Reception  &  Golf 
Tournament  Awards 

7:30  PM-9:30  PM 

NetIQ’s  Swingin’  Speakeasy 


Monday 


7:00AM-8:00  AM 

Registration  and  Breakfast 

8:00  AM-8:15  AM 

Conference  Welcome 

ABBIE  LUNDBERG 

Editor  in  Chief,  CIO  Magazine 

8:15  AM-9:00  AM 

Opening  Keynote 

PAUL  SAFFO,  Conference 
Moderator 

Director  and  Roy  Amara  Fellow, 
Institute  for  the  Future 
Saffo  talks  about  why  he  thinks  we 
are  poised  on  the  verge  of  an 
onslaught  of  technological  innova¬ 
tion  that  will  affect  every  corner  of 
business  and  society  in  the 
decades  ahead— even  though  at 
first  glance,  this  coming  wave 
seems  to  defy  anticipation,  much 
less  meaningful  assessment  of  its 
likely  impacts. 

9:00  AM-10:00  AM 

Creating  a  Cutting-Edge 
Culture 

Moderator:  RICK  SWANBORG, 

President,  ICEX 
Panelists: 

RIZWAN  AHMED,  CIO,  Louisiana 
Office  of  Group  Benefits 
ROBERT  DUTILE,  Group  Manager 
&  Executive  Vice  President, 
Enterprise  Architecture  Group, 
KeyCorp. 

JAN  FRANKLIN,  CIO  &  Vice 
President,  Farmers  Insurance 
Group 

ED  WOJCIECHOWSKI,  CIO, 
Menasha  Corporation 


In  today's  current  competitive  envi¬ 
ronment,  innovation  and  resource¬ 
fulness  are  more  important— and 
more  challenging— than  ever.  This 
panel  of  CIO  100  winners  describes 
how  they've  managed  to  be  simul¬ 
taneously  resourceful  and  forward- 
thinking,  creating  an  enterprise¬ 
wide  mindset  of  innovation  even  in 
the  toughest  of  times. 

10:00  AM-10:30  AM 

Innovation,  Leadership  & 
Resourcefulness 

CRAIG  CONWAY,  CEO,  Peoplesoft 

11:00  AM-11:45  AM 

Industry  Briefings 

Our  corporate  partners  present 
case  studies  and  sessions  on 
deploying  the  latest  technologies 
and  services. 

11:55  AM-12:25  PM 
Getting  Fast  and  Flexible 

JEFF  COHEN,  CIO,  JetBlue  Airways 
One  of  our  CIO  100  winners  shares 
how  they  developed  faster,  more 
flexible  processes  inside  and  out¬ 
side  the  company  despite  restric¬ 
tions  on  their  resources. 

12:35  PM-1:35  PM 

Networking  Luncheon 

1:45  PM-2:10  PM 

Creating  New  Methods  of 
Demonstrating  Value 

DOUGLAS  F.  BUSCH,  Executive 
Vice  President  &  CIO,  Intel 
Corporation 

In  tough  times,  we’re  under  more 
pressure  to  demonstrate  the  value 
of  every  IT  dollar.  But  if  traditional 
metrics  for  determining  and 


demonstrating  ROI  don’t  work  in 
your  case— create  new  ones.  This 
winner  did. 

2:10  PM  -  2:35  PM 
Creating  New  Tools  to 
Prioritize  IT  Initiatives 

ROBERT  WEIR,  Vice  President  of 
IS,  Northeastern  University 
Universities  always  operate  under 
financial  constraints  and  have  noto¬ 
riously  vocal  department  heads. 
How  do  you  develop  a  method  to 
really  evaluate  and  prioritize  all  IT 
initiatives  that  everyone  buys  into— 
and  that  works? 

2:45  PM-4:20  PM 

Industry  Briefings 

4:30  PM-5:30  PM 

Motivating  Employees  and 
Boosting  Morale 
Moderator:  MARTHA  HELLER, 

Director,  CIO  Best  Practice 
Exchange  &  CIO  Select 
Panelists: 

STEVEN  W.  AGNOLI,  CIO, 
Kirkpatrick  &  Lockhart  LLP 
MARY  FONDER,  CIO,  Maysteel  LLC 
J.  A.  GOTTRON  II,  Executive  Vice 
President  &  CIO,  The  Huntington 
National  Bank 

When  the  economy  enters  a  down¬ 
ward  spiral,  so  does  morale— and 
that  can  cause  productivity  and 
sales  to  hit  the  skids  as  well.  We 
bring  together  a  group  of  CIO  100 
winners  to  share  a  diverse  collec¬ 
tion  of  initiatives. 

5:30  PM-7:00  PM 

Cafe  100  Reception 


August  17-19, 2003  I  The  Broadmoor  I  Colorado  Springs,  CO 
To  enroll  I  800.355.0246  I  www.cio.com/conferences 


Our  award-winning  CIOs  share  ideas 
you  can  use  today,  as  they  tell  us 

What  Works  Now 

Some  of  our  favorite  thought-leaders 
look  into  the  future,  and  predict 

What  Lies  Ahead 


Tuesday 


7:00  AM-8:00  AM 

Breakfast  and  Informal 
Roundtable  Discussions 

Gather  with  CIO  magazine  editors 
and  fellow  attendees  to  discuss 
common  problems  and  possible 
solutions. 

8:00  AM-8:15  AM 

Welcome 

PAUL  SAFFO 

Conference  Moderator 

8:15  AM-9:15  AM 

Leading  in  an  Age  of 
Extraordinary  Challenge 
Moderator:  ABBiE  LUNDBERG, 

Editor  in  Chief,  CIO  Magazine 
Panelists: 

STEPHEN  N.  DAVID,  CIO  & 

Business-to-Business  Officer, 

Procter  &  Gamble 
TOM  MURPHY,  CIO,  Royal 
Caribbean  Cruise  Lines 
ANDRE  SPATZ,  CIO,  UNICEF 
BETTE  WALKER,  CIO  &  Vice 
President,  Delphi  Corporation 
Lundberg  hosts  a  panel  of  award¬ 
winning  CIOs.  They  discuss  our  cur¬ 
rent  state  of  evolution,  where  we're 
heading  and  the  requirements  of 
the  IT  leadership  role,  including 
shifting  accountability,  governance 
and  organization  models. 

9:15  AM-10:00  AM 

Leadership:  Partnering  In 
Action 

Most  businesses  are  only  as  strong 
as  their  executive  teams,  making 
the  relationship  between  the  "O's” 
more  critical  than  ever  during  diffi¬ 
cult  times. 


10:30  AM-11:15  AM 

Industry  Briefings 

11:25  AM-12:15  PM 

Smart  Mobs— Mobile 
Communications,  Pervasive 
Computing,  and  Collective 
Action 

HOWARD  RHEINGOLD 

Author,  Journalist,  Futurist  and 
Guru  of  Digital  Culture 
Smart  mobs  display  the  ultimate 
resourcefulness.  They  harness  the 
combination  of  mobile  communica¬ 
tion,  the  Internet  and  pervasive 
computing  to  enable  people  to 
cooperate  in  ways  never  before  pos¬ 
sible.  Rheingold  takes  a  hard  look 
at  the  driving  forces,  critical  uncer¬ 
tainties,  opportunities  and  threats 
posed  by  smart  mob  devices  and 
practices. 

12:30  PM-2:00  PM 

Networking  Luncheon 

2:00  PM-2:30  PM 

What  You  Need  to  Know 
About  Sarbanes-Oxley 
MICHAEL  CARPENTER,  Partner, 
KPMG 

At  our  April  CIO  Perspectives  con¬ 
ference,  several  CIOs  from  large, 
well-known  organizations  were  sur¬ 
prised  to  find  out  what  they  really 
needed  to  know  about  complying 
with  Sarbanes-Oxley,  and  about 
how  large  their  role  should  be.  We 
asked  Michael  Carpenter  to  help 
give  everyone  a  "head's  up”  on 
what  we  feel  is  an  important  issue 
for  CIOs. 

2:40  PM-3:25  PM 

Industry  Briefings 


3:40  PM-4:40  PM 

Looking  Ahead— IT 
Reinterpreted 

W.  BRIAN  ARTHUR 

Citibank  Professor,  Santa  Fe 
Institute 

Arthur  shares  his  views  on  how  IT 
is  being  reinterpreted  by  old,  tradi¬ 
tional  industries— resulting  in  com¬ 
pletely  new  sub-industries  such  as 
genomics,  proteomics,  financial 
engineering,  smart  pharmaceuti¬ 
cals,  nanotechnology,  and  the  like. 
They  are  being  born  out  of  IT,  and 
will  change  our  lives  and  our  busi¬ 
nesses. 

4:40  PM-5:00  PM 

Conversations— Going 
Forward 

Paul  Saffo,  W.  Brian  Arthur,  Howard 
Rheingold  and  Friends 
Over  the  past  two  days,  several  of 
our  CIO  100  award  winners  have 
shared  “what  works  now,”  and  our 
industry  gurus  have  provided  their 
views  about  “what  lies  ahead.”  We 
come  together  to  talk  about  what  it 
means  for  us  personally,  for  CIOs 
professionally,  and  for  our  organiza¬ 
tions  going  forward. 

5:00  PM-5:15  PM 

Final  Comments 

PAUL  SAFFO 


CIO  100 

Awards  Ceremony 

6:15  PM -11:00  PM 

★  CIO  100  Awards 
Reception 

★  CIO  100  Awards  Dinner 
&  Ceremony 

★  Dessert  Reception 

Hosted  by  CIO  100  Awards 
Ceremony  Underwriter, 
PeopleSoft,  Inc. 
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‘The  Select  Member  CIO 
you  put  me  in  touch  with 
was  knowledgeable, 
forthcoming  and  extremely 
helpful.  His  shop  and 
ours  have  much  in  common. 
The  call  was  excellent!” 

-CIO  of  a  $7  billion 
insurance  company 

‘I  am  getting  tremendous 
value  out  of  the  board-level 
presentations  I  have  down¬ 
loaded  from  Select.” 

-CIO  of  a  $3  billion 
manufacturer 


BENEFIT  FROM  THE  EXPERIENCE  OF  YOUR 
PEERS -JOIN  CIO  SELECT. 

CIO  Select  is  an  exclusive 
networking  program  that 
helps  CIOs  share  ideas, 
documents  and  advice. 


Membership  in  CIO  Select  is  reserved  for  CIOs 
of  midsize  to  large  organizations. 
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For  Information  and  Membership  Pricing: 

Contact  Martha  Heller,  Director,  CIO  Select, 
at  508.988.6738  or  mheller@cio.com  or 
via  www. cio. com/community/select.htmi 
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COVER  STORY 
Executive  Stress 

By  Christopher  Koch  I  40 

Fifty-two  percent  of  today’s  executives 
will  die  of  diseases  related  to  stress, 
according  to  Connie  Tyne,  executive 
director  of  the  Cooper  Wellness  Program. 
Constant  stress  does  more  than  damage 
your  health.  It  destroys  your  judgment  and 
distorts  your  decision-making  processes  by 
shrinking  a  part  of  the  brain  that  controls 
memory  and  concentration.  In  cavemen, 
three  major  psychological  factors  made 
stress  hormones  flow:  lack  of  control,  fear 
and  isolation.  Today’s  CIO  role  is  tailor- 
made  for  feeling  out  of  control.  Infrastruc¬ 
tures  can  crash  at  any  moment,  CEOs  can 
change  their  minds  and  stop  funding  proj¬ 
ects,  or  businesspeople  can  resist  using  your 
beautiful  new  system  for  no  good  reason.  You 
have  a  vast  amount  of  responsibility  but  lit¬ 
tle  authority  for  controlling  outcomes.  This 
is  what  psychologists  call  low  decision  lati¬ 
tude.  The  best  antidote  for  stress  is  exercise. 
Try  to  control  what  you  can,  and  shift 
accountability  for  things  you  can’t  control 
to  those  who  can.  Taking  breaks  during  the 
day  can  turn  off  the  fight-or-flight  response, 
at  least  temporarily.  Shut  the  door  for  five 
minutes  and  take  a  few  deep  breaths.  Visual¬ 
ize  something  nice,  like  a  vacation.  Another 
stress  mitigation  technique  is  to  build  a  sup¬ 
port  network  outside  work  that  you  can  talk 
to  about  what  you’re  experiencing. 


“You  need  for  your  staff  to 
know  that  you’re  human; 
you  don’t  need  your  staff 
to  know  that  you’re  weak.” 

-JIM  QUICK,  PROFESSOR  OF 
ORGANIZATIONAL  BEHAVIOR, 
UNIVERSITY  OF  TEXAS  AT  ARLINGTON 


Electronic  Medical  Records  By  Sarah  D.Scaiet  I  52 

AT  MAIMONIDES  MEDICAL  CENTER— a  705-bed  hospital  in  Brooklyn,  N.Y.— revenue 
increased  $50  million  last  year,  thanks  in  part  to  the  hospital’s  implementation  of  electronic  med¬ 
ical  records  and  computerized  physician  order-entry  systems  that  enable  physicians  to  order  med¬ 
ications  and  tests,  check  lab  results,  and  track  treatment  online.  Such  sophisticated  systems  could 
save  $2  billion  a  year  in  hospitalization  costs.  Yet,  at  present,  Maimonides  is  among  only  5  per¬ 
cent  of  U.S.  hospitals  that  have  implemented  order-entry  and  error  checking  capabilities  systems 
because  of  the  up-front  costs  and  resistance  from  physicians.  CIOs  must  drive  this  transformation, 
delivering  systems  without  incurring  potentially  deadly  downtime  or  allowing  medical  files  to  fall 
into  the  wrong  hands.  To  win  over  resistors,  CIOs  should  consider  one-on-one  training  for  physi¬ 
cians  rather  than  classroom  instruction.  They  should  also  try  to  deliver  early  value — once  physi¬ 
cians  get  something  out  of  the  system,  such  as  faster  lab-test  results,  they’ll  be  more  likely  to  accept 
further  changes. 


Wireless  Hospitals  ByGalenGruman  I  60 

WIRELESS  SYSTEMS,  especially  those  based  on  the  802.11b  standard  (also  known  as  Wi-Fi), 
are  becoming  more  widely  deployed  in  hospitals  today — where  patients  and  medical  staff  are  con¬ 
stantly  moving  and  it’s  difficult  for  staff  members  to  take  a  break  to  enter  patient  data  and  test 
results  or  to  order  tests  and  medications.  This  new  conduit  lets  staff  access  and  update  records  and 
make  orders  at  the  point  of  care.  That  reduces  transcription-related  errors  and  delays,  and  fits  into 
doctors’  and  nurses’  workflow.  The  systems  have  proven  relatively  inexpensive  to  deploy,  costing  a 
few  percent  of  the  overall  outlay  for  a  facilitywide  electronic  medical  records  system.  Several  early 
adopter  hospitals  share  lessons  learned  in  securing  the  sensitive  patient  data,  dealing  with  network 
performance  problems  such  as  delays  between  access  points  and  dropped  connections,  and  support¬ 
ing  multiple  types  of  wireless  access  devices. 


The  Software  Patent  Problem  By  Lawrence  Rosen  and  Mark  Radcliffe  I  66 
IS  THE  SOFTWARE  PATENT  SYSTEM  harmful  to  innovation?  Critics  accuse  big  software 
companies  of  creating  portfolios  of  thousands  of  patents  designed  to  legally  monopolize  innovation 
and  use  as  a  bargaining  chip  with  competitors.  Under  this  broken  system,  CIOs  are  increasingly  at 
risk  of  infringement.  Others  say  it’s  the  U.S.  Patent  and  Trade  Office  that  simply  needs  to  be  more 
careful  in  judging  what  is  appropriate  to  patent.  Concerned  CIOs  should  lobby  for  more  thorough 
examination  of  patent  applications  or  request  that  an  already  established  patent  be  reexamined.  In 
any  case,  since  a  patent  suit  can  divert  substantial  resources  of  the  vendor  and  may  even  make  the 
product  unavailable,  a  vendor’s  patent  strategy  should  be  as  much  a  part  of  your  due  diligence 
process  as  ROI  or  maintenance  fees. 


Emerging  Technology:  Patch  Management  ByBobVioiino  I  79 

ABERDEEN  GROUP  ESTIMATES  that  companies  and  government  agencies  spend  more  than 
$2  billion  a  year  to  handle  the  thousands  of  patches  issued  by  software  vendors.  Until  recently, 
when  security  vulnerabilities,  viruses  and  other  problems  appeared,  vendors  released  patches — and 
that  was  that.  A  maturing  class  of  patch-management  tools  promises  to  automate  the  process  of 
distributing  patches  while  making  sure  that  machines  get  only  the  updates  they  need.  But  no  tool 
yet  works  across  all  operating  environments,  and  companies  may  need  to  reduce  the  number  of 
configurations  they  maintain  to  get  a  complete  handle  on  patch  management  for  their  enterprises. 
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www.mscsoftware.com 


THE  BITTER  TRUTH  IS  THAT 

NOBODY 

CARES 

HOW  YOU  GET  THE  END  RESULT, 
JUST  THAT  YOU  DO. 

When  your  software  fails,  do  they  care?  When  you 
discover  your  systems  are  totally  inadequate,  are 
they  understanding?  Of  course  not. 

You  need  someone  to  be  there  with  you  from  A 
to  Z.  We're  here.  We  know.  We  understand.  If  it's 
important  to  you,  it's  important  to  us.  Because 
they  only  care  about  one  thing....  and  so  do  we. 


Software. 


SOFTWARE  I  SYSTEMS  I  SERVICES 


EMC2 

where  information  lives 


Have  you  seen 

THE  OTHER  SIDE  OF  EMC? 

OUR  SOFTWARE  GIVES  YOU  SOME 
VERY  SMART  CHOICES. 


To  manage  complexity,  you’ve  got  to  outsmart  it.  EMC  Automated  Networked  Storage™  delivers  the 
software  that  automates  management  of  your  multi-vendor  storage  infrastructure,  including  the  most 
error-prone  tasks  such  as  monitoring  and  provisioning.  Now  you  can  gain  a  unified,  end-to-end  view  of 
your  entire  environment.  Define  your  service  levels.  And  run  an  agile,  active  infrastructure  that  helps  the 
business  pounce  on  opportunity. 


See  how  other  companies  are  using  EMC  Automated  Networked  Storage  to  manage  more 
information  with  less  effort  atwww.EMC.com. 
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